Executive brief
HyperDX is an open-source observability platform that teams use to monitor and troubleshoot production systems. A flaw in its team management endpoints allows any team member to perform admin-level actions—including removing owners, rotating API keys, and renaming teams—regardless of their assigned role. This undermines access controls and could allow a disgruntled or compromised account to sabotage team operations and security credentials.
Technical details
The vulnerability is a role-based access control (RBAC) bypass in HyperDX's team management API endpoints. The affected endpoints (PATCH /team/apiKey, PATCH /team/name, DELETE /team/member) fail to validate user permissions before processing sensitive operations, allowing any authenticated team member to execute administrative actions. No special authentication or privileges are required beyond basic team membership. An attacker with a valid team member account can delete any team member including owners, rotate API keys to lock out legitimate users, or modify team settings. The issue affects versions through 1.10.1; patches may be available in newer releases.
Affected products
- HyperDX HyperDX through 1.10.1
Timeline
- 2026-08-28: disclosed