Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M

CVE-2026-62251Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

High 8.1

In plain English

A high-severity SQL injection in homer from sipcapture. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 62.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/sipcapture/homer-app	0.0.0-20260625085520-a7d027dc684b	GHSA-f46q-3v67-fmm4
Go	github.com/sipcapture/homer-app	no fix listed	GO-2026-6672

Affected products (as reported)

Vendor	Product	Versions
sipcapture	homer	< 11.0.283

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4 x_refsource_CONFIRM
https://github.com/sipcapture/homer/pull/837 x_refsource_MISC
https://github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0 x_refsource_MISC
https://github.com/sipcapture/homer/releases/tag/11.0.283 x_refsource_MISC