PT-2026-61689 · Hyperdxio · Hyperdx

George Chen · CVE-2026-63730 · Publicado 2026-07-20 · Atualizado 2026-07-20

NVD

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-63730

Produtos afetados

Hyperdx

Referências · 6

• 🔥 https://github.com/hyperdxio/hyperdx/issues/2588 · Exploit
• https://github.com/hyperdxio/hyperdx/releases/tag/%40hyperdx%2Fapp%402.31.0 · Nota
• https://github.com/hyperdxio/hyperdx/pull/2593 · Nota
• https://github.com/hyperdxio/hyperdx/commit/1705b37ac68acc222cd038327ed79e167e256a1b · Correção
• https://vulncheck.com/advisories/hyperdx-ssrf-via-webhook-test-endpoint · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63730 · Nota de Segurança