Skip to content
Connect AISign inSign up free

Bug bounty program

EL

Elastic

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
34
Disclosed reports
14
Subdomains
19,861
Vendor on CyberSIXT
Elastic (415 CVEs, 3 exploited)

Most upvoted reports14

All reports
Most upvoted reports of Elastic
ReportWeaknessDisclosedBountyVotes
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398Cross-site Scripting2021-08-16–157
CVE-2021-40870 on [52.204.160.31]Analysed#1356845Command and Code Injection2021-10-06–75
Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employeeAnalysed#1266188Cryptography2021-09-01–64
blind Server-Side Request Forgery (SSRF) allows scanning internal portsAnalysed#1300585Server-Side Request Forgery2023-05-05–54
Synthetics Recorder: Code injection when recording website with malicious contentAnalysed#1636382Command and Code Injection2023-04-08–47
CSRF in AppSearch allows creation of "curations"Analysed#1477050Cross-Site Request Forgery2022-11-17–35
RCE hazard in reporting (via Chromium)Analysed#1168765Access Control2021-05-26$10,00025
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine AccessAnalysed#1218680Access Control2021-08-03–21
Remote Code Execution in coming Kibana 7.7.0#861744Access Control2021-04-19$5,00014
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528Access Control2021-06-02–13

Subdomains19,861

Root:elastic.co
Scope
Name suggests:Development
First seen
Text fileClear filters26 names
Subdomains of Elastic
NameScopeFirst seen
cloud-dev.elastic.codevIn scope2026-11-14
dev.demo.elastic.codev, testIn scope2026-11-14
helm-dev.elastic.codevIn scope2026-11-14
kibitka-outdoometry-dev.elastic.codevIn scope2026-11-14
email.email.license-development.elastic.codevIn scope2026-11-14
oss-dependencies-dev.elastic.codevIn scope2026-11-14
dev-api.atlas.sa.elastic.coapi, devIn scope2026-11-14
demo-kibana-dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
dev.sa.elastic.codevIn scope2026-11-14
dev-atlas.sa.elastic.codevIn scope2026-11-14
catsize.dev.sa.elastic.codevIn scope2026-11-14
demo.dev.sa.elastic.codev, testIn scope2026-11-14
demo-kibana.dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
sa-demo-apachelogs.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-arcsight.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-cyclops.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-cyclops-kibana.dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
sa-demo-ece.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-honeypot-kibana.dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
sa-demo-kibana.dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
sa-demo-ml.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-operations.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-security.dev.sa.elastic.codev, testIn scope2026-11-14
embeddings-dev.sa.elastic.codevIn scope2026-11-14
telemetry-dev.elastic.codevIn scope2026-11-14
kibana.telemetry-dev.elastic.codev, monitoringIn scope2026-11-14

17,372 names are covered by the program's own scope; 5 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated