{"id":"GHSA-4j6x-w426-6rc6","aliases":[],"status":"published","title":"Default Express middleware security check is ignored in production","description":"## Default Express middleware security check is ignored in production\r\n\r\n### Impact\r\nAll Cube.js deployments that use affected versions of `@cubejs-backend/api-gateway` with default express authentication middleware in production environment are affected.\r\n\r\n### Patches\r\n@cubejs-backend/api-gateway@0.11.17\r\n\r\n### Workarounds\r\nOverride default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware\r\n\r\n### For more information\r\nIf you have any questions or comments about this advisory:\r\n* Open an issue in https://github.com/cube-js/cube.js/issues\r\n* Reach out us in community Slack: https://slack.cube.dev/","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-11-08T17:31:17Z","modified":"2023-01-09T05:02:44Z","fixes":[{"ecosystem":"npm","package":"@cubejs-backend/api-gateway","fixed_in":["0.11.17"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@cubejs-backend/api-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0"},{"last_affected":"0.11.16"},{"fixed":"0.11.17"}]}]},{"source":"osv","ecosystem":"npm","package":"@cubejs-backend/api-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"0.11.17"}]}]}],"references":[{"url":"https://github.com/cube-js/cube.js/security/advisories/GHSA-4j6x-w426-6rc6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4j6x-w426-6rc6","tags":["advisory"]}],"sources":{"ghsa":[{"id":"GHSA-4j6x-w426-6rc6","title":"Default Express middleware security check is ignored in production","description":"## Default Express middleware security check is ignored in production\r\n\r\n### Impact\r\nAll Cube.js deployments that use affected versions of `@cubejs-backend/api-gateway` with default express authentication middleware in production environment are affected.\r\n\r\n### Patches\r\n@cubejs-backend/api-gateway@0.11.17\r\n\r\n### Workarounds\r\nOverride default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware\r\n\r\n### For more information\r\nIf you have any questions or comments about this advisory:\r\n* Open an issue in https://github.com/cube-js/cube.js/issues\r\n* Reach out us in community Slack: https://slack.cube.dev/\r\n\r\n","status":"published","published":"2019-11-08T17:31:17Z","modified":"2023-01-09T05:02:44Z","updated_at":"2026-11-02T14:36:03.768255Z"}],"osv":[{"id":"GHSA-4j6x-w426-6rc6","title":"Default Express middleware security check is ignored in production","description":"## Default Express middleware security check is ignored in production\n\n### Impact\nAll Cube.js deployments that use affected versions of `@cubejs-backend/api-gateway` with default express authentication middleware in production environment are affected.\n\n### Patches\n@cubejs-backend/api-gateway@0.11.17\n\n### Workarounds\nOverride default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/cube-js/cube.js/issues\n* Reach out us in community Slack: https://slack.cube.dev/\n\n","status":"published","published":"2019-11-08T17:31:17Z","modified":"2020-06-16T20:58:26Z","updated_at":"2026-11-02T15:46:37.148947Z"}]}}