# CVE-2026-63731: HyperDX SSRF in ClickHouse proxy and webhook test endpoints

Source: https://junglewise.ai/threats/cve-2026-63731-hyperdx-ssrf-in-clickhouse-proxy-and-webhook-test-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-63731 · Severity: high · CVSS 7.7 · Published 2026-07-20

HyperDX, an observability platform, contains a security flaw that allows authorized team members to trick the server into making unauthorized requests to internal systems. By exploiting this, a user could access sensitive internal data, such as cloud provider credentials, database information, or private internal APIs that are not intended to be exposed. This could lead to a broader breach of the organization's internal infrastructure and cloud environment.

Technologies: [HyperDX](https://junglewise.ai/threats/technologies/hyperdx). Vendors: [HyperDX](https://junglewise.ai/threats/vendors/hyperdx).

## Quick answers

**Is CVE-2026-63731 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63731 being exploited in the wild.

**How severe is CVE-2026-63731?** High severity, with a CVSS score of 7.7, published 20 July 2026.

**Which products and versions are affected?** HyperDX before 2.31.0.

**Is there a fix for CVE-2026-63731?** A patch was published on 2026-07-17: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63731 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-63731?** Check whether you run HyperDX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

HyperDX is vulnerable to Server-Side Request Forgery (SSRF) in two authenticated endpoints: `POST /webhooks/test` and `POST /clickhouse-proxy/test`. The root cause is insufficient validation of user-supplied host parameters, which allows requests to bypass hostname blacklists using direct IP literals (including RFC 1918, loopback, and link-local addresses). In the ClickHouse proxy endpoint, the vulnerability is further escalated from blind to reflected SSRF because the application returns the raw response body from the target in its error messages. An authenticated attacker can exploit this to probe internal services, access containerized sidecars, or retrieve sensitive credentials from cloud metadata endpoints (e.g., 169.254.169.254). The issue is mitigated in version 2.31.0 by implementing private IP blocking and redacting error responses, though DNS rebinding remains a known gap.

## Affected products

- hyperdxio HyperDX before 2.31.0

## Timeline

- 2026-06-01: disclosed: Originally reported via GHSA-fgcx-qxjr-wx26
- 2026-07-17: patched: Fix committed to main branch
- 2026-07-20: advisory: CVE-2026-63731 published

## References

- [https://github.com/hyperdxio/hyperdx/commit/1705b37ac68acc222cd038327ed79e167e256a1b](https://github.com/hyperdxio/hyperdx/commit/1705b37ac68acc222cd038327ed79e167e256a1b)
- [https://github.com/hyperdxio/hyperdx/issues/2588](https://github.com/hyperdxio/hyperdx/issues/2588)
- [https://github.com/hyperdxio/hyperdx/pull/2593](https://github.com/hyperdxio/hyperdx/pull/2593)
- [https://github.com/hyperdxio/hyperdx/releases/tag/%40hyperdx%2Fapp%402.31.0](https://github.com/hyperdxio/hyperdx/releases/tag/%40hyperdx%2Fapp%402.31.0)
- [https://www.vulncheck.com/advisories/hyperdx-ssrf-via-clickhouse-proxy-test-endpoint](https://www.vulncheck.com/advisories/hyperdx-ssrf-via-clickhouse-proxy-test-endpoint)

## Related threats

- [HyperDX role-based access control bypass in team management](https://junglewise.ai/threats/cve-2026-82279-hyperdx-role-based-access-control-bypass-in-team-management)
- [HyperDX SSRF in webhook and ClickHouse proxy test endpoints](https://junglewise.ai/threats/cve-2026-63730-hyperdx-ssrf-in-webhook-and-clickhouse-proxy-test-endpoints)