CVE-2026-62251
highHomer is open source telecom observability software.
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.
CVSS
8.1
8.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-10-07 17:16
Modified: 2026-10-08 21:09
NVD status: Awaiting Analysis
Last synced 2 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0 security-advisories@github.com
- https://github.com/sipcapture/homer/pull/837 security-advisories@github.com
- https://github.com/sipcapture/homer/releases/tag/11.0.283 security-advisories@github.com
- https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4 security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗