HyperDX (<= 1.10.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hyperdx--1.10.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 28 Aug 2026 21:38:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper Access Control in HyperDX Team Managementhttps://feed.craftedsignal.io/briefs/2026-08-hyperdx-auth-bypass/Fri, 28 Aug 2026 21:38:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-hyperdx-auth-bypass/HyperDX versions through 1.10.1 contain an improper access control vulnerability allowing authenticated users to perform unauthorized administrative actions via team management API endpoints.HyperDX versions through 1.10.1 contain a critical authorization flaw within their team management API endpoints. Due to a failure to properly enforce role-based access controls (RBAC), any authenticated team member can bypass existing permission tiers to execute administrative functions. An attacker with standard user access can manipulate team settings, including renaming the team, rotating API keys, and removing other users, including the team owner. This vulnerability presents a significant risk to organizational account security and sensitive data access if administrative tokens are compromised. Defenders should identify HyperDX instances and verify the software version against the patched release.

Impact

Successful exploitation allows unauthorized users to modify team configurations and gain administrative control over the platform. This may lead to service disruption, account lockout for authorized administrators, or potential exfiltration of sensitive telemetry data via rotated API keys.

Recommendation

  • Patch HyperDX instances by upgrading to the latest version that addresses CVE-2026-82279.
  • Audit logs for suspicious activity involving PATCH or DELETE requests directed at /team/ endpoints, specifically monitoring for non-admin accounts performing team management functions.
]]>highadvisoryprivilege-escalationweb-application-security