Skip to content
Sign in

Bug bounty program

CP

Cloudflare Public Bug Bounty

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
51
Disclosed reports
44
Subdomains
24,296
Vendor on CyberSIXT
Cloudflare (70 CVEs, 0 exploited)

Most upvoted reports44

All reports
Most upvoted reports of Cloudflare Public Bug Bounty
ReportWeaknessDisclosedBountyVotes
HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() functionAnalysed#1478633Injection and Smuggling2022-05-16$6,000116
Cloudflare CASB Confused Deputy ProblemAnalysed#1952124No weakness recorded2023-06-07$3,30097
Using special IPv4-mapped IPv6 addresses to bypass local IP ban#1785260No weakness recorded2023-01-24$7,50078
Bypass of Cloudflare's Cache Keys and WAF via header overflow#3027461Access Control2025-11-18–77
Hijack all emails sent to any domain that uses Cloudflare Email Forwarding#1419341Access Control2022-07-28$6,00076
`use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using it#3211031Cross-site Scripting2025-09-30$55075
Yet Another CASB Integration Takeover of Active Integrations#2094346No weakness recorded2023-11-13–68
[Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuth#3423950Cross-site Scripting2026-04-14–63
AI Playground XSS to steal user-chat messages and access to connected MCP Server#3424998Cross-site Scripting2026-02-26–62
Bypass R2 payment screen#2170559Authentication2023-11-10$35057

Subdomains24,296

Root
Scope
Name suggests:Build and CI
First seen
Text fileClear filters3 names
Subdomains of Cloudflare Public Bug Bounty
NameScopeFirst seen
builds.mcp.cloudflare.comciIn scope2026-11-14
builds-staging.mcp.cloudflare.comci, stagingIn scope2026-11-14
paf-ci.cloudflareaccess.comciNot in the scope2026-11-14

18,933 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in