Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-62251 · GHSA-f46q-3v67-fmm4

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Risk score
59/100
CVSS
8.1 v3.1
Exploit chance (30 days)
0.3%
Published
7 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL st…
Affected
github.com/sipcapture/homer-app (go) < 0.0.0-20260625085520-a7d027dc684b
Fix
Upgrade github.com/sipcapture/homer-app to 0.0.0-20260625085520-a7d027dc684b or later.
Exploitation
No known exploitation

Story map

Story map: github.com/sipcapture/homer-appTHE FLAWSTHE FIXCVE-2026-62251Homer: Authenticated SQLInjection via Unvalidatedrawquery Field in…CVSS 8.1 · EPSS 0%CVE-2026-62252Homer: Hardcoded DefaultAdmin Password 'sipcapture'With No Forced Change on…CVSS 9.8 · EPSS 1%CVE-2026-62253Homer: CompleteAuthentication Bypass Whencoordinator.jwt.secret Is…CVSS 9.8 · EPSS 0%Upgrade…11.0.283or later on your release lineWho is exposedgithub.com/sipcapture/homer-app (go) <0.0.0-20260625091610-b2e942031ff8AMBER · PATCH THIS WEEKgithub.com/sipcapture/homer-appHomer is open source telecomobservability software. Prior toversion 11.0.283, on every freshHomer deployment using internalauthentication, the bootstrapprocess automatically createsan admin account with the…Where it standsNo known exploitationCONNECTS TOSame weaknessSQL injection (CWE-89)400 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/sipcapture/homer-app: Amber, patch this week. Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism…

The flaws

  • CVE-2026-62251: Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query (CVSS 8.1 · EPSS 0%)
  • CVE-2026-62252: Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login (CVSS 9.8 · EPSS 1%)
  • CVE-2026-62253: Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) (CVSS 9.8 · EPSS 0%)

The fix

Upgrade github.com/sipcapture/homer-app: 11.0.283 or later on your release line

Who is exposed: github.com/sipcapture/homer-app (go) < 0.0.0-20260625091610-b2e942031ff8

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.1 high
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/sipcapture/homer-appgo< 0.0.0-20260625085520-a7d027dc684b0.0.0-20260625085520-a7d027dc684b

References

Original description

Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.

Last activity 7 Oct 2026. Patch Forecast updates every hour.