SSRF in Hyperdxio Hyperdx
CVE-2026-63730
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.004 (33.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.
Affected products
- Hyperdxio Hyperdx — versions 2.0.0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (issue-tracking, technical-description, exploit)
- disclosure@vulncheck.com (issue-tracking, patch)
- disclosure@vulncheck.com (release-notes, patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-63730?
- CVE-2026-63730 is a medium-severity vulnerability in Hyperdxio Hyperdx, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.0/10. Published 2026-07-20.
- How severe is CVE-2026-63730?
- Medium severity. CVSS v3 base score is 5.0 out of 10.