CVE-2026-62251: Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-07 · updated 2026-10-08
Weakness: CWE-89

Description

Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.

Affected products

sipcapture homer: before 11.0.283

References

https://github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0
https://github.com/sipcapture/homer/pull/837
https://github.com/sipcapture/homer/releases/tag/11.0.283
https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4

Get alerted when CVE-2026-62251 or the next vulnerability affects your stack