CVE-2026-63731: HyperDX SSRF Vulnerability

CVE-2026-63731 Overview

CVE-2026-63731 is a server-side request forgery (SSRF) vulnerability in HyperDX versions prior to 2.31.0. The flaw resides in the ClickHouse proxy test endpoint, which accepts a caller-controlled host parameter without URL validation or allowlist enforcement. Authenticated team members can direct the HyperDX server to send HTTP requests to arbitrary internal destinations. Reflected error responses disclose internal service response bodies, enabling reconnaissance and data extraction from internal APIs, container services, and cloud provider metadata endpoints. The vulnerability is tracked under CWE-918 and was patched in the @hyperdx/app@2.31.0 release.

Critical Impact
Authenticated attackers can pivot from HyperDX to internal-only services and cloud metadata endpoints such as AWS IMDS, enabling theft of instance credentials and internal API data.

Affected Products

HyperDX all versions before 2.31.0
HyperDX API package containing packages/api/src/routers/api/clickhouseProxy.ts
Self-hosted HyperDX deployments exposing the ClickHouse proxy test endpoint

Discovery Timeline

2026-07-20 - CVE-2026-63731 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63731

Vulnerability Analysis

HyperDX exposes a ClickHouse proxy test endpoint that accepts a host parameter from authenticated users and issues a server-side HTTP request to validate ClickHouse connectivity. The endpoint performs no scheme restriction, no host allowlisting, and no filtering of private, loopback, or link-local addresses. An authenticated team member can supply hosts such as http://127.0.0.1, http://localhost:PORT, RFC1918 addresses, or http://169.254.169.254 and receive the target's response body reflected through the error handler.

The reflected response behavior converts the SSRF primitive into a read-capable channel. Attackers can enumerate internal HTTP services, retrieve container orchestration metadata, and extract cloud instance identity documents. On AWS environments running IMDSv1, this path leads directly to temporary IAM credential theft.

Root Cause

The root cause is missing input validation on a network destination parameter [CWE-918]. The clickhouseProxy.ts router accepted user-supplied hosts and passed them to the outbound HTTP client without checking whether the resolved IP fell within private, loopback, or metadata ranges. The patch introduces isPrivateIp and IPV6_BRACKET_RE validators imported from @/utils/validators and applies them before the request is dispatched. The same guard was added to the webhook delivery path in packages/api/src/tasks/checkAlerts/template.ts, and ClickHouse proxy error responses are now redacted to prevent leakage of internal response bodies.

Attack Vector

Exploitation requires network access to the HyperDX API and valid team-member credentials. The attacker submits a crafted request to the ClickHouse proxy test endpoint with the host parameter pointing to an internal target. The server issues the request and returns the error body containing the internal service response.

typescript

// Security patch in packages/api/src/routers/api/clickhouseProxy.ts
 import { validateRequestHeaders } from '@/middleware/validation';
 import { recordOperationOutcome } from '@/utils/instrumentation';
 import logger from '@/utils/logger';
+import { IPV6_BRACKET_RE, isPrivateIp } from '@/utils/validators';
 import { objectIdSchema } from '@/utils/zod';

 // SLO operations for the ClickHouse proxy. Both paths swallow their errors

Source: GitHub Commit 1705b37

The companion patch hardens webhook alert delivery, which shares the same SSRF risk profile:

typescript

// Security patch in packages/api/src/tasks/checkAlerts/template.ts
 import logger from '@/utils/logger';
 import { withRetry } from '@/utils/retry';
 import * as slack from '@/utils/slack';
+import { IPV6_BRACKET_RE, isPrivateIp } from '@/utils/validators';

 // Webhook delivery is the last (and most failure-prone) hop of an alert.

Source: GitHub Commit 1705b37

Detection Methods for CVE-2026-63731

Indicators of Compromise

Outbound HTTP requests from the HyperDX API container to 169.254.169.254, 127.0.0.1, or RFC1918 addresses that do not match legitimate ClickHouse hosts.
Requests to the ClickHouse proxy test endpoint containing host parameters referencing localhost, loopback, link-local, or private IP ranges.
Unexpected access patterns to cloud metadata service endpoints originating from the HyperDX service account or pod identity.

Detection Strategies

Inspect HyperDX API access logs for calls to the ClickHouse proxy test route with anomalous host parameter values.
Enable IMDSv2 on AWS instances and alert on any IMDSv1 fallback requests originating from the HyperDX workload.
Correlate authenticated HyperDX user activity with outbound network flows leaving the application segment for internal-only destinations.

Monitoring Recommendations

Add egress firewall logging for the HyperDX API service and alert on connections to metadata IPs or non-approved internal ranges.
Monitor NVD and the VulnCheck Security Advisory on SSRF for updates to CVE-2026-63731.
Track HyperDX release notifications through the GitHub Release @hyperdx/app v2.31.0 page.

How to Mitigate CVE-2026-63731

Immediate Actions Required

Upgrade HyperDX to version 2.31.0 or later, which enforces private-IP blocking in the ClickHouse proxy and webhook paths.
Restrict network egress from the HyperDX API container to only the ClickHouse hosts and third-party services required for operation.
Rotate any cloud instance credentials or API tokens accessible from the HyperDX workload if exploitation is suspected.

Patch Information

The fix is delivered in commit 1705b37ac68acc222cd038327ed79e167e256a1b and published in the @hyperdx/app@2.31.0 release. The patch adds isPrivateIp validation in packages/api/src/routers/api/clickhouseProxy.ts and packages/api/src/tasks/checkAlerts/template.ts, and redacts ClickHouse proxy error responses. Review the GitHub Pull Request #2593 and GitHub Issue #2588 for full context.

Workarounds

Place the HyperDX API behind a network policy that blocks outbound requests to loopback, RFC1918, and 169.254.169.0/16 ranges.
Enforce IMDSv2 on AWS EC2 hosts and set hop-limit=1 to prevent container-based SSRF from reaching the metadata service.
Restrict HyperDX team-member accounts to trusted operators and audit membership regularly until the patch is deployed.

bash

# AWS CLI: enforce IMDSv2 with hop limit 1 to block containerized SSRF pivots
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled

# Kubernetes NetworkPolicy: block HyperDX egress to metadata and private ranges
# Apply after allowing approved ClickHouse destinations explicitly