CVE-2026-63730

Name of the Vulnerable Software and Affected Versions HyperDX versions prior to 2.31.0

Description Authenticated team members can perform a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended destination. By providing a controlled URL to the webhook test endpoint, attackers can bypass insufficient hostname blacklist validation in the webhook handler. This allows for the enumeration of internal services, interaction with internal containers, or access to cloud instance metadata services, including provider metadata endpoints.

Recommendations Update to version 2.31.0 or later.