Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-63730HyperDX < 2.31.0 SSRF via Webhook Test Endpoint

Medium 5.0

In plain English

A medium-severity server-side request forgery in hyperdx from hyperdxio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.4%top 65.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.

Affected products (as reported)

Vendor	Product	Versions
hyperdxio	hyperdx	2.0.0 – before 2.31.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

Researcher Disclosure technical-description, exploit, issue-tracking
HyperDX 2.31.0 Release Notes patch, release-notes
Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/hyperdx-ssrf-via-webhook-test-endpoint third-party-advisory