Junglewise Threat Intelligence

CVE-2026-63730: HyperDX SSRF in webhook and ClickHouse proxy test endpoints

CVE-2026-63730 · Severity: medium · CVSS 5 · Published 2026-07-20

Technologies: Hyperdxio HyperDX. Vendors: HyperDX.

Executive brief

HyperDX, an observability platform, contains a security flaw that allows authorized team members to trick the server into making unauthorized requests to internal systems. By exploiting this, a user could scan the internal corporate network, access sensitive cloud metadata (such as security credentials), or interact with internal databases that are not supposed to be reachable from the web interface. This could lead to the exposure of internal infrastructure details or cloud service credentials.

Technical details

HyperDX contains two Server-Side Request Forgery (SSRF) vulnerabilities. The first exists in the 'POST /webhooks/test' endpoint where the 'validateWebhookUrl' function only blacklisted specific hostnames (CLICKHOUSE_HOST and MONGO_URI) but failed to block private IP literals (RFC 1918, loopback, and link-local addresses like 169.254.169.254). The second exists in 'POST /clickhouse-proxy/test', which lacked protocol restrictions and reflected the first 100 characters of the target's response body in error messages, enabling a reflected SSRF. An authenticated attacker can use these to enumerate internal services, interact with Docker containers, or leak cloud provider metadata. Version 2.31.0 mitigates these by implementing private IP checks and redacting reflected error bodies, though DNS rebinding remains a known gap.

Affected products

  • hyperdxio HyperDX 2.0.0 to 2.30.x (before 2.31.0)

Timeline

  • 2026-06-01: disclosed: Originally reported via GHSA-fgcx-qxjr-wx26
  • 2026-07-17: patched: Fix merged in commit 1705b37
  • 2026-07-20: advisory: CVE-2026-63730 published to NVD

References

Related threats