Vulnerability Description
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/hyperdxio/hyperdx
- https://github.com/hyperdxio/hyperdx/blob/db6ee45feadb2e229bb234364b8661903f8e38
- https://github.com/hyperdxio/hyperdx/issues/2587
- https://www.vulncheck.com/advisories/hyperdx-team-management-operations-missing-
- https://github.com/hyperdxio/hyperdx/issues/2587
FAQ
What is CVE-2026-82279?
CVE-2026-82279 is a vulnerability with a CVSS score of 8.1 (HIGH). HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including...
How severe is CVE-2026-82279?
CVE-2026-82279 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82279?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.