Back to overview

CVE-2026-63731

HIGH Exploitation: PoC
7.7
CVSS 3.1
Description
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist enforcement. Attackers can exploit the reflected error responses from the endpoint to disclose internal service response bodies, enabling access to internal APIs, container services, and cloud provider metadata endpoints.

Metadata

CVE ID
CVE-2026-63731
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-18 12:03 UTC
Published
2026-07-20 18:45 UTC
Last updated
2026-07-21 16:14 UTC
Primary CWE
CWE-918
Server-Side Request Forgery (SSRF)
Vendor / Product
hyperdxio / hyperdx
Sources
cve.org  ·  NVD

Severity & Metrics

7.7 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
hyperdxio hyperdx — 2.0.0 < 2.31.0
Weakness (CWE)
CWESourceDescription
CWE-918 cna Server-Side Request Forgery (SSRF)
CVSS scores (2)
ScoreSeverityVersionSourceVector
7.7 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
6.3 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
References (5)
Back to overview