@cubejs-backend/api-gateway row level security bypass

Description

All authenticated Cube clients could bypass row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint.

Recommendation

Update the @cubejs-backend/api-gateway package to the latest compatible version. Followings are version details:

• Affected version(s): = 0.31.23
• Patched version(s): 0.31.24

References

• GHSA-6jqm-3c9g-pch7
• CVE-2022-23510
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API - CVE-2026-33888
• isolated-vm has vulnerable CachedDataOptions in API - CVE-2022-39266
• copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action - CVE-2026-6874
• Strapi Upload Plugin MIME Validation Bypass via Content API - CVE-2026-22707

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@cubejs-backend/api-gateway