---
id: "CVE-2026-62251"
kind: "vulnerability"
aliases: ["CVE-2026-62251", "GHSA-f46q-3v67-fmm4", "GO-2026-6672"]
title: "Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app"
severity: "high"
cvss: 8.1
epss: 0.00341
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/sipcapture/homer-app", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/sipcapture/homer-app", "fixed": ["11.0.283", "v0.0.0-20260625085520-a7d027dc684b"], "affected": "<= 11.0.281 (before pseudo-version v0.0.0-20260625085520-a7d027dc684b)", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "homer", "package", "self-hosted", "sip", "sql-injection", "voip"]
not_affected_if: ["managed-hosting", "no-homer-deployment", "patched-11.0.283", "unauthenticated-only-exposure"]
published_at: "2026-10-07T17:16:56+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:43:37+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6672", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-62251", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62251", "first_seen_at": "2026-10-23T19:14:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:43:37+00:00"}]
---

# Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app

Homer (sipcapture/homer, Go module homer-app) 11.0.281 and earlier: POST /api/v4/statistics/query passes the rawquery field to DuckDB/FlightSQL with no validation. Any authenticated user can run arbitrary SQL and read all stored SIP/call records. On deployments with an empty JWT secret, which was the default, no credentials are needed. Fixed in 11.0.283, which also removes the hardcoded default admin password and enforces JWT when the secret is empty.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/sipcapture/homer-app affected all versions fixed ?
- go:github.com/sipcapture/homer-app affected <= 11.0.281 (before pseudo-version v0.0.0-20260625085520-a7d027dc684b) fixed 11.0.283, v0.0.0-20260625085520-a7d027dc684b

## How to check

Check the installed Homer version (homer-core --version, or the package: dpkg -l homer-core / rpm -q homer-core). 11.0.281 or older is vulnerable. Check exposure: authenticated POST to /api/v4/statistics/query is the route; see whether it is reachable from untrusted networks. Check whether coordinator.jwt.secret is empty in the config: if so, the API is effectively open.

## Fix

Upgrade to Homer 11.0.283 or later. It validates rawquery (read-only SQL only), enforces JWT when the secret is empty and writes .homer_jwt_secret, and drops the default admin password 'sipcapture'. Until upgraded: set a strong coordinator.jwt.secret, change the admin password, and do not expose the API to untrusted networks. After upgrading, review the coordinator logs for the bootstrap password and jwt_secret_file.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6672
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-62251
- 2026-10-23T19:14:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62251
- 2026-10-23T21:43:37+00:00 analyst — Read GHSA-f46q-3v67-fmm4 and release 11.0.283 (primary). Fixed in Homer 11.0.283 (homer-app pseudo-version a7d027dc684b); affected <= 11.0.281. Advisory has a PoC curl but no exploitation reports; no X chatter. NVD page returned nothing. Severity High, CVSS 8.1 matches the vendor. The advisory says an empty default JWT secret makes this effectively unauthenticated; the same release fixes that as GHSA-rqcc-94gv-wjm9.

## Documents

- [advisory] GHSA-f46q-3v67-fmm4 Homer authenticated SQLi https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4
- [fix] Homer 11.0.283 security release https://github.com/sipcapture/homer/releases/tag/11.0.283
- [mentions] GO-2026-6672 https://pkg.go.dev/vuln/GO-2026-6672

## From the sources

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/sipcapture/homer-app before v0.0.0-20260625085520-a7d027dc684b.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_