CVE-2026-63731 describes an SSRF vulnerability in HyperDX prior to version 2.31.0. The issue arises because the ClickHouse proxy test endpoint accepts a caller-controlled host parameter without URL validation or allowlist enforcement. Authenticated users can exploit this to direct server requests to arbitrary internal destinations. The vulnerability allows attackers to obtain reflected error responses containing internal service response bodies, potentially exposing sensitive internal resources such as APIs, container services, and cloud metadata endpoints.

An authenticated team member can exploit this SSRF vulnerability to access internal network resources that are normally inaccessible externally. This includes internal APIs, container services, and cloud provider metadata endpoints, which may lead to information disclosure and further internal reconnaissance. The vulnerability does not require user interaction beyond authentication and has a medium severity rating (CVSS 6.3). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated and the remediation level is unspecified, users should monitor vendor communications for updates. In the meantime, restrict authenticated user permissions to trusted personnel only and consider network-level controls to limit access to internal services from the HyperDX server.