Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N N N N 5.3 .0023 14.4 —
AFFECTED Product Versions Fixed hyperdx 2.0.0 – —
TIMELINE Jul 18 Reserved by VulnCheck Jul 20 Published (CNA: VulnCheck) Jul 21 EXPLOIT PUBLISHED — CVE-2026-63730 (hyperdxio hyperdx). Public exploit reference added.
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.
| Date | Event | Detail |
|---|---|---|
| July 18, 2026 | Reserved | Reserved by VulnCheck |
| July 20, 2026 | Published | Published (CNA: VulnCheck) |
| July 21, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-63730 (hyperdxio hyperdx). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| hyperdxio | hyperdx | — | 2.0.0 | — |
Authoritative record: CVE-2026-63730 at cve.org
Vendors: hyperdxio
Weaknesses: CWE-918
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-63730 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.