Attack Chain

1. An authenticated team member (attacker) logs into the HyperDX platform, establishing an authorized session.
2. The attacker crafts a malicious HTTP request specifically targeting the vulnerable ClickHouse proxy test endpoint within the HyperDX application, typically located at a path like /api/proxy/clickhouse/test.
3. Within the request, the attacker injects an arbitrary internal IP address or domain (e.g., 169.254.169.254 for AWS EC2 metadata, 10.0.0.1 for an internal service) into the host parameter.
4. The HyperDX server, without proper validation, attempts to establish a connection to the attacker-specified internal host or service.
5. During this connection attempt, the server receives a response (or error) from the internal target, and this response body is reflected back to the attacker as part of the HyperDX application's HTTP response.
6. The attacker analyzes the reflected data, which may contain sensitive information such as cloud provider credentials, internal API keys, or details about running container services.
7. This disclosed information facilitates internal network reconnaissance, allowing the attacker to map the internal infrastructure and potentially gain access to further sensitive internal resources.

Impact

Successful exploitation of CVE-2026-63731 can lead to significant information disclosure and internal network reconnaissance. Attackers can access sensitive data such as cloud provider metadata (e.g., AWS EC2 instance metadata containing temporary credentials), internal API endpoints, and details about container services running within the organization's infrastructure. While the vulnerability is authenticated, it allows an insider threat or an attacker who has compromised a legitimate user's credentials to escalate privileges and expand their foothold within the network. The CVSS v3.1 Base Score for this vulnerability is 7.7, indicating a high severity risk.

Recommendation

• Patch CVE-2026-63731 immediately by updating HyperDX to version 2.31.0 or newer on all affected instances.
• Deploy the Sigma rule "Detects CVE-2026-63731 Exploitation - HyperDX SSRF" to your SIEM and tune for your environment to detect exploitation attempts.
• Enable comprehensive web server logging for all HyperDX instances to ensure cs-uri-stem and cs-uri-query fields are captured for the webserver category log source.