CVE-2026-62251

Summary

A SQL injection vulnerability in Homer's V4StatisticsQuery handler allows authenticated users to execute arbitrary SQL commands against the FlightSQL service database. This occurs because user-supplied rawquery input is not validated before being passed to DuckDB, potentially enabling attackers to access or manipulate sensitive telecom data.

Exploitability

The exploit requires an authenticated user account with access to the V4StatisticsQuery endpoint, which is relatively easy to achieve in environments where Homer is deployed with user authentication enabled.

Blast radius

If exploited, this vulnerability could allow attackers to read, modify, or delete sensitive telecom data stored in the FlightSQL service, potentially affecting network monitoring and observability across the entire system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 11.0.283 or later to patch the SQL injection vulnerability in the V4StatisticsQuery handler.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.