HIGH 8.1 NVD
CVE-2026-62251
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field direct
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.
References
- https://github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0
- https://github.com/sipcapture/homer/pull/837
- https://github.com/sipcapture/homer/releases/tag/11.0.283
- https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4
This high severity vulnerability with a CVSS score of 8.1 was published on 2026-10-07 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.