EUVD-2026-46066
GHSA-2f42-7f9w-fc76
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requires authenticated team member (PR:L); scope changes because the server proxies requests to internal/subsequent systems (S:C); confidentiality impact is low, bounded by what internal services expose.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.
AnalysisAI
Server-side request forgery in HyperDX before 2.31.0 allows authenticated team members to weaponize the server's network identity against internal infrastructure by supplying attacker-controlled URLs to the webhook test endpoint. The root cause is an insufficient hostname blacklist that can be bypassed using IPv6 notation (e.g., http://[fd00::1]/path) or other alternate IP representations, enabling enumeration of internal services, interaction with internal containers, and retrieval of cloud instance metadata including IMDSv1 credential endpoints. No public exploit code has been identified and the vulnerability is not in CISA KEV, though the GitHub issue and fix PR are publicly visible, making the attack surface discoverable.
Technical ContextAI
HyperDX is an open-source observability platform. The flaw (CWE-918, Server-Side Request Forgery) exists in at least two endpoints: the webhook test handler (/webhooks/test) and the ClickHouse proxy. Both accepted caller-supplied URLs and attempted to filter dangerous destinations via a hostname blacklist - an inherently bypassable approach since private IP ranges can be expressed in IPv6 bracket notation, decimal encoding, or other forms not caught by simple string matching. The fix (commit 1705b37) introduces the ip-address npm package (v10.2.0) for proper RFC-compliant IP-range validation, adds strict protocol allowlisting (http/https only, blocking file://, gopher://, and similar schemes), covers both IPv4 and IPv6 private ranges, and removes raw response body reflection from ClickHouse proxy errors to prevent leaking internal service output. Affected packages per the changeset: @hyperdx/common-utils, @hyperdx/hdx-eval, @hyperdx/api, @hyperdx/app, and @hyperdx/cli.
RemediationAI
Upgrade HyperDX to version 2.31.0 or later, available at https://github.com/hyperdxio/hyperdx/releases/tag/%40hyperdx%2Fapp%402.31.0 and detailed in the VulnCheck advisory at https://www.vulncheck.com/advisories/hyperdx-ssrf-via-webhook-test-endpoint. For deployments that cannot be upgraded immediately, two compensating controls are most impactful: first, enforce IMDSv2 on any cloud instance hosting HyperDX - this requires token-based metadata requests and cannot be satisfied by a simple SSRF GET, neutralizing the credential-theft chain without affecting HyperDX functionality; second, apply egress firewall rules on the HyperDX server host to block outbound connections to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and ULA IPv6 (fc00::/7), accepting the trade-off that legitimate webhook destinations on private networks will also be blocked. Restricting the webhook test endpoint to administrator-only roles via network policy or application-layer access control reduces the exploitable user population but does not eliminate the vulnerability.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today