CVE-2026-82279
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
Risk Assessment
The risk includes unauthorized administrative actions such as deleting team owners or rotating API keys, potentially leading to team takeover and security compromise.
Recommendation
Update HyperDX to a patched version and implement strict role-based access controls. Also regularly review team member permissions.
Other vulnerabilities in HyperDX
See all- CVE-2026-63731High
SSRF vulnerability in HyperDX before version 2.31.0. Authenticated team members can direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint, without URL validation or allowlist. Attackers can exploit error responses to disclose internal service responses.
- CVE-2026-63730Medium
HyperDX before version 2.31.0 contains a server-side request forgery (SSRF) vulnerability. Authenticated team members can direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.
Original NVD description (English source)
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.