PT-2026-61689 · Hyperdxio · Hyperdx

George Chen · CVE-2026-63730 · Published 2026-07-20 · Updated 2026-07-20

NVD

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-63730

Affected Products

Hyperdx

References · 6

• 🔥 https://github.com/hyperdxio/hyperdx/issues/2588 · Exploit
• https://github.com/hyperdxio/hyperdx/commit/1705b37ac68acc222cd038327ed79e167e256a1b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-63730 · Security Note
• https://github.com/hyperdxio/hyperdx/releases/tag/%40hyperdx%2Fapp%402.31.0 · Note
• https://github.com/hyperdxio/hyperdx/pull/2593 · Note
• https://vulncheck.com/advisories/hyperdx-ssrf-via-webhook-test-endpoint · Note