Bug bounty program

Elastic

Platform: HackerOne
Bounties: Pays
Assets in scope: 34
Disclosed reports: 14
Subdomains: 19,861
Vendor on CyberSIXT: Elastic (415 CVEs, 3 exploited)

Most upvoted reports14

Most upvoted reports of Elastic
Report	Weakness	Disclosed	Bounty	Votes
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398	Cross-site Scripting	2021-08-16	–	157
CVE-2021-40870 on [52.204.160.31]Analysed#1356845	Command and Code Injection	2021-10-06	–	75
Critical \|\| Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employeeAnalysed#1266188	Cryptography	2021-09-01	–	64
blind Server-Side Request Forgery (SSRF) allows scanning internal portsAnalysed#1300585	Server-Side Request Forgery	2023-05-05	–	54
Synthetics Recorder: Code injection when recording website with malicious contentAnalysed#1636382	Command and Code Injection	2023-04-08	–	47
CSRF in AppSearch allows creation of "curations"Analysed#1477050	Cross-Site Request Forgery	2022-11-17	–	35
RCE hazard in reporting (via Chromium)Analysed#1168765	Access Control	2021-05-26	$10,000	25
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine AccessAnalysed#1218680	Access Control	2021-08-03	–	21
Remote Code Execution in coming Kibana 7.7.0#861744	Access Control	2021-04-19	$5,000	14
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528	Access Control	2021-06-02	–	13

Subdomains19,861

Root:elastic-cloud.com

Scope

Name suggests:Sign-in

First seen

Text fileClear filters1 names

Subdomains of Elastic
Name	Scope	First seen
auth.usgov.aws.elastic-cloud.comauth	Not in the scope	2026-11-14

17,372 names are covered by the program's own scope; 5 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.