HyperDX versions before 2.31.0 contain a server‑side request forgery flaw that allows an authenticated team member to specify any URL to the webhook test endpoint, causing the server to perform the request. The attacker can direct calls to arbitrary internal IP addresses, enumerating services, interacting with internal containers, or retrieving cloud instance metadata from provider‑specific endpoints. This flaw is a classic SSRF described by CWE‑918.

The vulnerability affects HyperDX software distributed by hyperdxio, any release earlier than 2.31.0, regardless of deployment environment. Only users with authentication credentials for a team in HyperDX can exploit this feature.

The CVSS score of 5.3 marks the flaw as moderate severity. The EPSS score is under 1%, indicating a very low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires valid credentials for a team member; once authenticated, the attacker can trigger the webhook test endpoint with a target URL, bypassing the insufficient hostname blacklist validation and thus gaining access to internal network resources or sensitive cloud metadata.