{"id":"CVE-2026-62251","published":"2026-10-07T17:16:56.303","lastModified":"2026-10-08T21:09:00.643","description":"Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0","tags":[]},{"url":"https://github.com/sipcapture/homer/pull/837","tags":[]},{"url":"https://github.com/sipcapture/homer/releases/tag/11.0.283","tags":[]},{"url":"https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4","tags":[]}],"exploitRefs":[{"url":"https://github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0","tags":[]},{"url":"https://github.com/sipcapture/homer/pull/837","tags":[]},{"url":"https://github.com/sipcapture/homer/releases/tag/11.0.283","tags":[]},{"url":"https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4","tags":[]}],"hasPoc":true,"ai":{"summary":"A SQL injection vulnerability in Homer's V4StatisticsQuery handler allows authenticated users to execute arbitrary SQL commands against the FlightSQL service database. This occurs because user-supplied rawquery input is not validated before being passed to DuckDB, potentially enabling attackers to access or manipulate sensitive telecom data.","exploitability":"The exploit requires an authenticated user account with access to the V4StatisticsQuery endpoint, which is relatively easy to achieve in environments where Homer is deployed with user authentication enabled.","blast_radius":"If exploited, this vulnerability could allow attackers to read, modify, or delete sensitive telecom data stored in the FlightSQL service, potentially affecting network monitoring and observability across the entire system.","remediation":"Upgrade to version 11.0.283 or later to patch the SQL injection vulnerability in the V4StatisticsQuery handler.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","telecom","observability"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:58:27.961Z"}}