CVE-2026-62251

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

CVE-2026-62251

Homer, an open-source telecom observability software, is vulnerable to SQL Injection (CWE-89) in versions prior to 11.0.283 . The V4StatisticsQuery handler in coordinator/handlers/statistics_v4.go fails to call the sqlvalidator.ValidateRawSQL function, allowing it to pass the user-supplied rawque...