CVE-2026-62251
HighCVSS 8.1Summary
Homer, open source telecom observability software, before version 11.0.283 is vulnerable to SQL injection in the V4StatisticsQuery handler. The user-supplied rawquery field is passed directly to DuckDB without calling sqlvalidator.ValidateRawSQL, allowing any authenticated user to execute arbitrary SQL statements against all data accessible via the FlightSQL service.
Risk Assessment
An authenticated attacker can access, modify, or delete all data stored in the system, including potentially sensitive telecom information. The risk of data confidentiality and integrity breach is very high.
Recommendation
Upgrade Homer to version 11.0.283 or later which includes the fix. Additionally, restrict access to trusted users and monitor logs for unusual SQL queries.
Other vulnerabilities in Homer
See all- CVE-2026-62253Critical
Homer, open source telecom observability software, prior to version 11.0.283 has a vulnerability where JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret` is empty. The JWT secret defaults to an empty string, leaving all protected API endpoints completely unauthenticated.
- CVE-2026-62252Critical
Homer prior to version 11.0.283, on every fresh deployment using internal authentication, automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism, allowing any attacker to gain full administrative access.
Original NVD description (English source)
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS