CVE-2026-63731

Name of the Vulnerable Software and Affected Versions HyperDX versions prior to 2.31.0

Description Authenticated team members can perform a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended destination. By providing a caller-controlled host parameter to the ClickHouse proxy test endpoint, an attacker can direct the server to arbitrary internal destinations due to a lack of URL validation or allowlist enforcement. This allows the disclosure of internal service response bodies through reflected error responses, enabling unauthorized access to internal APIs, container services, and cloud provider metadata endpoints.

Recommendations Update to version 2.31.0 or later. Restrict network access to minimize the risk of internal probing.