CVE-2026-82279

HyperDX through version 1.10.1 fails to enforce role-based access controls (CWE-862) on its team management endpoints, so any authenticated team member — not just administrators — can perform administrative actions. An attacker with ordinary team membership sends requests to PATCH /team/apiKey, PATCH /team/name, or DELETE /team/member to rotate the team's API keys, rename the team, or delete other members, including owners. Because API key rotation can break downstream ingestion and integrations and owner accounts can be removed, the practical impact is high on integrity and availability, which is reflected in the CVSS 4.0 score of 7.2 (high) with low privileges required and no user interaction. Any organization running an affected self-hosted HyperDX deployment is exposed to this flaw. There is no evidence of exploitation so far: no public proof-of-concept is known, it is not in the CISA KEV catalog, and EPSS puts the 30-day exploitation probability at about 0.3%.

What to do: Upgrade HyperDX to a release newer than 1.10.1 as soon as a patched version with team-management RBAC enforcement is available (no fixed version is specified in the advisory data). Until then, restrict team membership to fully trusted users, limit network exposure of the HyperDX UI/API, and check audit logs for unexpected deletions of members (especially owners), API key rotations, or team renames; re-sync any integrations if a key was rotated.