Starstruk Logo MarkStarstruk

11.0.313

sipcapture/homer11.0.313Aug 8, 2026by adubovikov

AI Summary

Addresses security vulnerabilities by enforcing raw SQL validation and authentication on node query endpoints.

Key Highlights

  • Enforce `ValidateRawSQL` on node `POST /query` endpoint.
  • Implement Bearer auth when `flight_server.auth_token` is set.
  • Block `sqlite_scan` and other DuckDB external scanners.

Full Release Notes

## What's Changed
* fix(security): harden node `/query` auth and block `sqlite_scan` by @adubovikov in https://github.com/sipcapture/homer/pull/927

### Security
- **GHSA-rm5w-rqr7-2h54**: Node HTTP `POST /query` (port+1) now always runs `ValidateRawSQL`; Bearer auth when `flight_server.auth_token` is set; auto-token on non-loopback binds (`.homer_node_auth_token`). Coordinator sends `nodes[].token`.
- **GHSA-4687-q698-mccv**: Block `sqlite_scan` and other DuckDB external scanners in `ValidateRawSQL`.

See [SECURITY.md](https://github.com/sipcapture/homer/blob/homer11/docs/SECURITY.md).

**Full Changelog**: https://github.com/sipcapture/homer/compare/11.0.312...11.0.313