Kubernetes · disclosed reports
Cryptography
10 disclosed reports · $750 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Kubernetes on HackerOne- reports
- 10
- paid a bounty
- 2
Every one of the 10 is a mark on the map. Named now: 1 to 10, most upvoted first.
- elections.k8s.io uses weak session secret key, may place elections at risk
- Development Application Credentials + Information Exposed
- SHA512 incorrect on most/many releases
- IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements
- Man in the middle leading to root privilege escalation using hostNetwork=true (CAP_NET_RAW considered harmful)
- Private RSA key and Server key exposed on the GitHub repository
- secret leaks in vsphere cloud controller manager log
- Man in the middle using LoadBalancer or ExternalIPs services
- kubectl creating secrets from stringData leaves secret in plain text
- CVE-2019-11250 remains in effect.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.