High severity · published Oct 7, 2026
CVE-2026-62251
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
homer · sipcapture
< 11.0.283 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62251
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62251
x_refsource_CONFIRM
https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4
x_refsource_MISC
https://github.com/sipcapture/homer/pull/837
x_refsource_MISC
https://github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0
x_refsource_MISC
https://github.com/sipcapture/homer/releases/tag/11.0.283
More from homer
9.8
CVE-2026-62252
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
9.8
CVE-2026-62253
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)