CVE-2026-63730
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
HyperDX before version 2.31.0 contains a server-side request forgery (SSRF) vulnerability. Authenticated team members can direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.
Risk Assessment
The risk is that an attacker can perform reconnaissance of internal infrastructure, interact with sensitive containers, and steal credentials from cloud metadata, potentially leading to privilege escalation and data breach.
Recommendation
It is recommended to immediately upgrade HyperDX to version 2.31.0 or later, which includes a fix for the SSRF vulnerability.
Other vulnerabilities in HyperDX
See all- CVE-2026-82279High
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
- CVE-2026-63731High
SSRF vulnerability in HyperDX before version 2.31.0. Authenticated team members can direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint, without URL validation or allowlist. Attackers can exploit error responses to disclose internal service responses.
Original NVD description (English source)
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.