CVE-2026-63730: HyperDX SSRF Vulnerability

CVE-2026-63730 Overview

CVE-2026-63730 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting HyperDX versions prior to 2.31.0. The flaw resides in the webhook test endpoint, where the hostname blacklist validation is insufficient to prevent requests to internal network destinations. Authenticated team members can supply a caller-controlled URL that instructs the server to issue outbound HTTP requests to arbitrary internal targets. Attackers can enumerate internal services, interact with adjacent containers, or reach cloud instance metadata services, including provider metadata endpoints commonly exposed at link-local addresses.

Critical Impact
Authenticated attackers can pivot HyperDX into a proxy for internal network reconnaissance and cloud metadata theft, exposing service credentials and internal infrastructure.

Affected Products

HyperDX versions prior to 2.31.0
HyperDX API package (@hyperdx/app) webhook subsystem
Deployments exposing the webhook test endpoint to authenticated team members

Discovery Timeline

2026-07-20 - CVE-2026-63730 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63730

Vulnerability Analysis

HyperDX exposes a webhook test endpoint that allows team members to validate outbound webhook integrations. The handler accepts a user-supplied URL and issues an HTTP request from the HyperDX server process. Prior to version 2.31.0, the handler enforced only a hostname blacklist rather than validating the resolved IP address. This design allows attackers to bypass filtering with encoded hostnames, DNS names that resolve to private ranges, or IPv6 representations of internal addresses.

Because the request originates from the HyperDX API server, it inherits the trust boundary of that host. In cloud deployments the server can query the instance metadata service (IMDS) at 169.254.169.254 and retrieve temporary IAM credentials. In container orchestrated environments the server can reach sibling containers, ClickHouse backends, and administrative APIs bound to loopback or overlay networks.

Root Cause

The root cause is insufficient input validation on the destination URL supplied to the webhook test flow. The original implementation relied on a static hostname deny-list without resolving the final IP address or blocking private, loopback, link-local, and reserved ranges. The upstream fix introduces an isPrivateIp validator and IPv6 bracket handling that are invoked before the outbound request is dispatched.

Attack Vector

An authenticated user with permissions to configure or test webhooks issues a request to the webhook test endpoint with a target URL such as http://169.254.169.254/latest/meta-data/ or http://127.0.0.1:8123. The server performs the fetch and returns response data or timing information sufficient to enumerate reachable services. The attacker iterates through internal address ranges to map services, then targets metadata endpoints or unauthenticated admin interfaces.

typescript

// Patch: packages/api/src/routers/api/clickhouseProxy.ts
 import { validateRequestHeaders } from '@/middleware/validation';
 import { recordOperationOutcome } from '@/utils/instrumentation';
 import logger from '@/utils/logger';
+import { IPV6_BRACKET_RE, isPrivateIp } from '@/utils/validators';
 import { objectIdSchema } from '@/utils/zod';

// Patch: packages/api/src/tasks/checkAlerts/template.ts
 import logger from '@/utils/logger';
 import { withRetry } from '@/utils/retry';
 import * as slack from '@/utils/slack';
+import { IPV6_BRACKET_RE, isPrivateIp } from '@/utils/validators';

Source: HyperDX security commit 1705b37. The fix imports an isPrivateIp validator and IPv6 bracket regex into both the ClickHouse proxy and webhook delivery paths, ensuring private, loopback, and link-local addresses are blocked before requests are dispatched.

Detection Methods for CVE-2026-63730

Indicators of Compromise

Outbound HTTP requests from the HyperDX API container to RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254
Webhook test invocations targeting hosts that do not match legitimate integration endpoints such as Slack, PagerDuty, or corporate webhook receivers
Cloud audit log entries showing IMDS credential retrieval originating from the HyperDX host in the absence of expected workload activity

Detection Strategies

Inspect HyperDX application logs for webhook test calls and correlate the destination URL parameter against an allow-list of expected receivers
Alert on any DNS resolution from the HyperDX process that returns private or link-local IP addresses
Monitor for anomalous use of temporary cloud credentials issued to the HyperDX instance role from external or unexpected IP addresses

Monitoring Recommendations

Enable egress logging on the container or VM hosting HyperDX and forward events to a centralized analytics platform
Configure alerts on repeated 4xx or 5xx responses to internal address space, which often indicate SSRF enumeration
Track version and patch state of the HyperDX deployment to ensure 2.31.0 or later is in production

How to Mitigate CVE-2026-63730

Immediate Actions Required

Upgrade HyperDX to version 2.31.0 or later, which introduces the isPrivateIp guard in the webhook and proxy handlers
Restrict webhook configuration and test permissions to a minimal set of administrative users
Rotate any cloud instance credentials, API keys, or secrets that may have been exposed through the metadata service if compromise is suspected

Patch Information

The fix is delivered in HyperDX @hyperdx/app@2.31.0. Refer to the HyperDX 2.31.0 release notes, the tracking issue #2588, pull request #2593, and the VulnCheck SSRF advisory for full remediation details.

Workarounds

Block egress traffic from the HyperDX host to 169.254.169.254, 127.0.0.0/8, and internal RFC1918 ranges except for required backends
Enforce IMDSv2 with hop limit set to 1 on AWS deployments to prevent SSRF-based credential theft
Place the HyperDX server behind an egress proxy that enforces destination allow-listing for webhook traffic

bash

# Enforce IMDSv2 with a hop limit of 1 on the HyperDX EC2 instance
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled