# CVE-2026-63730: HyperDX SSRF in webhook and ClickHouse proxy test endpoints

Source: https://junglewise.ai/threats/cve-2026-63730-hyperdx-ssrf-in-webhook-and-clickhouse-proxy-test-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-63730 · Severity: medium · CVSS 5 · Published 2026-07-20

HyperDX, an observability platform, contains a security flaw that allows authorized team members to trick the server into making unauthorized requests to internal systems. By exploiting this, a user could scan the internal corporate network, access sensitive cloud metadata (such as security credentials), or interact with internal databases that are not supposed to be reachable from the web interface. This could lead to the exposure of internal infrastructure details or cloud service credentials.

Technologies: [HyperDX](https://junglewise.ai/threats/technologies/hyperdx). Vendors: [HyperDX](https://junglewise.ai/threats/vendors/hyperdx).

## Quick answers

**Is CVE-2026-63730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63730 being exploited in the wild.

**How severe is CVE-2026-63730?** Medium severity, with a CVSS score of 5, published 20 July 2026.

**Which products and versions are affected?** HyperDX 2.0.0 to 2.30.x (before 2.31.0).

**Is there a fix for CVE-2026-63730?** A patch was published on 2026-07-17: Fix merged in commit 1705b37 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63730 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-63730?** Check whether you run HyperDX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

HyperDX contains two Server-Side Request Forgery (SSRF) vulnerabilities. The first exists in the 'POST /webhooks/test' endpoint where the 'validateWebhookUrl' function only blacklisted specific hostnames (CLICKHOUSE_HOST and MONGO_URI) but failed to block private IP literals (RFC 1918, loopback, and link-local addresses like 169.254.169.254). The second exists in 'POST /clickhouse-proxy/test', which lacked protocol restrictions and reflected the first 100 characters of the target's response body in error messages, enabling a reflected SSRF. An authenticated attacker can use these to enumerate internal services, interact with Docker containers, or leak cloud provider metadata. Version 2.31.0 mitigates these by implementing private IP checks and redacting reflected error bodies, though DNS rebinding remains a known gap.

## Affected products

- hyperdxio HyperDX 2.0.0 to 2.30.x (before 2.31.0)

## Timeline

- 2026-06-01: disclosed: Originally reported via GHSA-fgcx-qxjr-wx26
- 2026-07-17: patched: Fix merged in commit 1705b37
- 2026-07-20: advisory: CVE-2026-63730 published to NVD

## References

- [https://github.com/hyperdxio/hyperdx/commit/1705b37ac68acc222cd038327ed79e167e256a1b](https://github.com/hyperdxio/hyperdx/commit/1705b37ac68acc222cd038327ed79e167e256a1b)
- [https://github.com/hyperdxio/hyperdx/issues/2588](https://github.com/hyperdxio/hyperdx/issues/2588)
- [https://github.com/hyperdxio/hyperdx/pull/2593](https://github.com/hyperdxio/hyperdx/pull/2593)
- [https://github.com/hyperdxio/hyperdx/releases/tag/%40hyperdx%2Fapp%402.31.0](https://github.com/hyperdxio/hyperdx/releases/tag/%40hyperdx%2Fapp%402.31.0)
- [https://www.vulncheck.com/advisories/hyperdx-ssrf-via-webhook-test-endpoint](https://www.vulncheck.com/advisories/hyperdx-ssrf-via-webhook-test-endpoint)

## Related threats

- [HyperDX role-based access control bypass in team management](https://junglewise.ai/threats/cve-2026-82279-hyperdx-role-based-access-control-bypass-in-team-management)
- [HyperDX SSRF in ClickHouse proxy and webhook test endpoints](https://junglewise.ai/threats/cve-2026-63731-hyperdx-ssrf-in-clickhouse-proxy-and-webhook-test-endpoints)