CVE-2026-82279: HyperDX Auth Bypass Vulnerability

CVE-2026-82279 Overview

CVE-2026-82279 is a broken access control vulnerability in HyperDX through version 1.10.1. The application fails to enforce role-based access controls on team management endpoints. Any authenticated team member can invoke administrative operations reserved for owners. Attackers can delete team members including owners, rotate API keys, and rename teams. The vulnerable endpoints are PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member. The flaw is classified under CWE-862: Missing Authorization.

Critical Impact
A low-privileged team member can remove owners, rotate API keys to disrupt integrations, and rename teams, resulting in full takeover of the HyperDX tenant and loss of observability telemetry integrity.

Affected Products

HyperDX through version 1.10.1
HyperDX API service (packages/api) team router
Self-hosted HyperDX deployments exposing team management endpoints

Discovery Timeline

2026-08-28 - CVE-2026-82279 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82279

Vulnerability Analysis

HyperDX is an open-source observability platform for logs, metrics, and traces. The team router in packages/api/src/routers/api/team.ts exposes endpoints intended for team owners. These endpoints do not verify the caller's role before executing the requested action. Any user holding a valid session for the team can call them. The impact aligns with a broken access control pattern where authentication is verified but authorization is not.

Successful exploitation lets an attacker rotate the team API key, breaking every downstream integration that ingests telemetry with that key. Renaming the team causes user confusion and can be paired with phishing. Deleting the owner removes the only account able to restore configuration, producing a denial-of-service and account takeover condition.

Root Cause

The root cause is missing authorization middleware on privileged handlers. The PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member routes check that the caller is authenticated and belongs to the team, but do not check the caller's role. Owner-only actions execute for any member. See the team router source and GitHub Issue #2587.

Attack Vector

Exploitation requires network access to the HyperDX API and a valid non-owner team member session. The attacker sends an authenticated HTTP request to one of the three vulnerable endpoints. No user interaction and no additional privileges are needed. Refer to the VulnCheck advisory for endpoint-level detail.

No verified public exploit code is available. The vulnerability can be reproduced by issuing standard REST calls to the affected paths using a low-privileged member's bearer token.

Detection Methods for CVE-2026-82279

Indicators of Compromise

Unexpected PATCH /team/apiKey requests originating from non-owner accounts in HyperDX API access logs.
Sudden API key rotation events followed by ingestion failures from telemetry agents using the previous key.
DELETE /team/member requests targeting owner accounts, especially when initiated by recently added or low-privileged members.
Team name changes recorded via PATCH /team/name that were not requested by an administrator.

Detection Strategies

Correlate HyperDX audit logs with the caller identity to flag privileged team operations executed by non-owner roles.
Alert on any successful call to PATCH /team/apiKey, PATCH /team/name, or DELETE /team/member outside of a planned change window.
Baseline the normal rate of team management operations and trigger on deviations.

Monitoring Recommendations

Forward HyperDX API access logs to a centralized SIEM and retain them for at least 90 days.
Monitor telemetry ingestion pipelines for authentication failures that follow API key changes.
Track membership changes and reconcile them against ticketing or change-management records.

How to Mitigate CVE-2026-82279

Immediate Actions Required

Restrict network exposure of the HyperDX API to trusted networks or place it behind an authenticating reverse proxy that enforces role checks.
Audit current team membership and remove any accounts that do not require access.
Review recent HyperDX audit logs for unauthorized calls to the affected endpoints and rotate any API keys suspected of exposure.
Track the upstream fix through the HyperDX GitHub repository and apply the patched release when available.

Patch Information

At the time of publication, HyperDX versions through 1.10.1 are affected and no fixed release has been referenced in the NVD entry. Monitor GitHub Issue #2587 and the VulnCheck advisory for the fix version and upgrade guidance.

Workarounds

Deploy an API gateway or reverse proxy in front of HyperDX and enforce role-based access on the PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member paths.
Limit team membership to trusted operators until a patched version is available.
Store HyperDX ingestion API keys in a secrets manager and monitor for unexpected rotation events.
Segment the HyperDX management interface from general user networks to reduce the population of accounts that can reach the vulnerable routes.

bash

# Example NGINX snippet restricting privileged team endpoints to an admin CIDR
location ~ ^/api/team/(apiKey|name|member)$ {
    allow 10.0.10.0/24;   # admin subnet
    deny  all;
    proxy_pass http://hyperdx_api;
}