CVE-2026-82279: HyperDX Team Management Operations Missing Role-Based Access Control
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HyperDXto a version that resolves this vulnerability.Fixed in 1.10.1Patch HyperDX Team Management Operations Missing Role-Based Access Control - Configuration
Enable/enforce RBAC for the team management endpoints so only users with appropriate roles can perform administrative actions, preventing non-admin team members from using PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member.
HyperDX team management endpoints role-based access control (RBAC) enforcement for team operations = enabled
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated member of a HyperDX team can exploit the affected team management endpoints. Administrative privileges are not required.
What actions can an unauthorized team member perform?
A team member can delete other members, including owners, rotate team API keys, and rename the team. The affected endpoints are PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member.
Which versions are affected?
HyperDX through version 1.10.1 is affected.