CVE-2026-63730
Received Received - Intake

HyperDX SSRF via Webhook Test Endpoint Before 2.31.0

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63730
EUVD
EUVD-2026-46066

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hyperdx hyperdx to 2.31.0 (exc)
hyperdx hyperdx From 2.0.0 (inc) to 2.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in HyperDX versions before 2.31.0. Authenticated team members can exploit it by supplying a custom URL to the webhook test endpoint, tricking the server into making requests to arbitrary internal network destinations. The vulnerability bypasses insufficient hostname blacklist validation, allowing attackers to probe internal services, interact with containers, or access cloud metadata endpoints like provider metadata services.

Detection Guidance

To detect this SSRF vulnerability in HyperDX versions before 2.31.0, monitor outbound requests from your HyperDX server to internal or unexpected destinations. Check logs for POST requests to /webhooks/test or /clickhouse-proxy/test endpoints with arbitrary URLs. Use network monitoring tools to identify requests to private IPs (RFC 1918 ranges, loopback, link-local) or cloud metadata endpoints like 169.254.169.254.

Impact Analysis

An attacker with valid access could enumerate internal services, interact with internal containers, or access cloud instance metadata services. This may lead to data leakage, exposure of sensitive information, or potential theft of IAM credentials from cloud metadata endpoints. The impact depends on the internal network configuration and services exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected HyperDX versions may face compliance violations, data breaches, and potential regulatory penalties if internal systems are compromised.

Mitigation Strategies

Upgrade HyperDX to version 2.31.0 or later to apply the SSRF fixes. If upgrading is not immediately possible, restrict access to the affected endpoints (/webhooks/test, /clickhouse-proxy/test) to trusted users only. Block outbound requests to private IP ranges and cloud metadata endpoints at your firewall level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart