Kubernetes · disclosed reports
Access Control
14 disclosed reports · $5,250 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Kubernetes on HackerOne- reports
- 14
- paid a bounty
- 3
Every one of the 14 is a mark on the map. Named now: 1 to 14, most upvoted first.
- Authenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespaces
- Privilege Escalation in kOps using GCE/GCP Provider
- File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow
- Ingress-nginx path allows retrieval of ingress-nginx serviceaccount token
- Github Account Takeover from Docs page of `kubernetes-csi.github.io`
- Google storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSS
- Node Validation Admission does not observe all oldObject fields
- Broken Link Hijacking on kubernetes.io Documentation
- Broken Link Takeover from kubernetes.io docs
- Grafana Improper authorization
- Holes in EndpointSlice Validation Enable Host Network Hijack
- KOPS documentation references domains which were not registered
- Broken Github Link Used in deployment docs of "github.com/kubernetes/kompose"
- Kubelet follows symlinks as root in /var/log from the /logs server endpoint
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.