CVE-2026-62251

Status: Awaiting AnalysisHigh (8.1)—

Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base score: 8.1

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.34%
Percentile among all scored CVEs: 26
Score date: 10/15/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1005 Data from Local Systemcollection90 %
Secondary impactT1078 Valid Accountsstealth · persistence · privilege escalation · initial access70 %
Secondary impactT1565.001 Stored Data Manipulationimpact75 %

Red con PR:L requiere acceso autenticado (T1210). SQL injection sin validación permite leer datos (T1005) y modificarlos (T1565.001) en DuckDB. Acesso remoto a servicio con credenciales válidas.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Application Developer Guidance Active Directory Configuration Vulnerability Scanning User Training User Account Management

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Homer — Homer^AI

CWEs

CWE-89

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-62251",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-62251",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-07T21:59:27.093310Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "sipcapture",
          "product": "homer",
          "versions": [
            {
              "status": "affected",
              "version": "< 11.0.283"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-07T17:16:56.303",
  "references": [
    {
      "url": "https://github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/sipcapture/homer/pull/837",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/sipcapture/homer/releases/tag/11.0.283",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue."
    }
  ],
  "lastModified": "2026-10-08T21:09:00.643",
  "sourceIdentifier": "security-advisories@github.com"
}