Skip to content
Connect AISign inSign up free

Bug bounty program

CP

Cloudflare Public Bug Bounty

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
51
Disclosed reports
44
Subdomains
24,298
Vendor on CyberSIXT
Cloudflare (70 CVEs, 0 exploited)

Most upvoted reports44

All reports
Most upvoted reports of Cloudflare Public Bug Bounty
ReportWeaknessDisclosedBountyVotes
HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() functionAnalysed#1478633Injection and Smuggling2022-05-16$6,000116
Cloudflare CASB Confused Deputy ProblemAnalysed#1952124No weakness recorded2023-06-07$3,30097
Using special IPv4-mapped IPv6 addresses to bypass local IP banAnalysed#1785260No weakness recorded2023-01-24$7,50078
Bypass of Cloudflare's Cache Keys and WAF via header overflow#3027461Access Control2025-11-18–77
Hijack all emails sent to any domain that uses Cloudflare Email ForwardingAnalysed#1419341Access Control2022-07-28$6,00076
`use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using itAnalysed#3211031Cross-site Scripting2025-09-30$55075
Yet Another CASB Integration Takeover of Active IntegrationsAnalysed#2094346No weakness recorded2023-11-13–68
[Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuthAnalysed#3423950Cross-site Scripting2026-04-14–63
AI Playground XSS to steal user-chat messages and access to connected MCP ServerAnalysed#3424998Cross-site Scripting2026-02-26–62
Bypass R2 payment screenAnalysed#2170559Authentication2023-11-10$35057

Subdomains24,298

Root
Scope
Name suggests:VPN and remote access
First seen
Text fileClear filters21 names
Subdomains of Cloudflare Public Bug Bounty
NameScopeFirst seen
access.cloudflare.comvpnIn scope2026-11-14
instant-logs-access.logs.fed.cloudflare.commonitoring, vpnIn scope2026-11-14
rdp.euwest-canary.labs-staging.cloudflare.comstaging, vpnIn scope2026-11-14
access-trail.research.cloudflare.comvpnIn scope2026-11-14
vpn.cloudflare.comvpnIn scope2026-11-14
access-control.cloudflareaccess.comvpnNot in the scope2026-11-14
access-hub.cloudflareaccess.comvpnNot in the scope2026-11-14
access-testing.cloudflareaccess.comtest, vpnNot in the scope2026-11-14
adverts-access.cloudflareaccess.comvpnNot in the scope2026-11-14
az-bar-foundation-restricted-access.cloudflareaccess.comvpnNot in the scope2026-11-14
citrix.cloudflareaccess.comvpnNot in the scope2026-11-14
covid19-how-to-secure-remote-application.cloudflareaccess.comvpnNot in the scope2026-11-14
access-scout.fed.cloudflareaccess.comvpnNot in the scope2026-11-14
jam247access.cloudflareaccess.comvpnNot in the scope2026-11-14
one-access.cloudflareaccess.comvpnNot in the scope2026-11-14
petpaw-access.cloudflareaccess.comvpnNot in the scope2026-11-14
remote.cloudflareaccess.comvpnNot in the scope2026-11-14
sslvpn.cloudflareaccess.comvpnNot in the scope2026-11-14
vpn.cloudflareaccess.comvpnNot in the scope2026-11-14
vpn-portal.cloudflareaccess.comvpnNot in the scope2026-11-14
website-access.cloudflareaccess.comvpnNot in the scope2026-11-14

18,935 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated