CVE-2026-62251
Received Received - Intake

SQL Injection in Homer Telemetry Software

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-62251
EUVD
EUVD-2026-94522

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sipcapture homer < 11.0.283

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Homer, an open source telecom observability software. It allows authenticated users to execute arbitrary SQL commands through the FlightSQL service due to improper input validation in the V4StatisticsQuery handler. The rawquery field is passed directly to DuckDB without proper sanitization.

Detection Guidance

Check Homer versions prior to 11.0.283 using system package managers or Docker images. Inspect API endpoints for unauthenticated access to POST /api/v4/statistics/query with rawquery parameters. Monitor for unexpected SQL execution patterns in logs.

Impact Analysis

An attacker with access could read, modify, or delete sensitive telecom data accessible through the FlightSQL service. This includes call records, user data, and other observability metrics. The impact depends on the data accessible via the service.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected Homer versions may face compliance violations and potential fines.

Mitigation Strategies

Upgrade Homer to version 11.0.283 or later. Ensure JWT authentication is enforced by verifying the .homer_jwt_secret file exists. Rotate default admin passwords and disable predictable credentials. Validate all SQL queries through the updated endpoint validation rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart