Bug bounty program

Elastic

Platform: HackerOne
Bounties: Pays
Assets in scope: 34
Disclosed reports: 14
Subdomains: 19,861
Vendor on CyberSIXT: Elastic (415 CVEs, 3 exploited)

Most upvoted reports14

Most upvoted reports of Elastic
Report	Weakness	Disclosed	Bounty	Votes
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398	Cross-site Scripting	2021-08-16	–	157
CVE-2021-40870 on [52.204.160.31]Analysed#1356845	Command and Code Injection	2021-10-06	–	75
Critical \|\| Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employeeAnalysed#1266188	Cryptography	2021-09-01	–	64
blind Server-Side Request Forgery (SSRF) allows scanning internal portsAnalysed#1300585	Server-Side Request Forgery	2023-05-05	–	54
Synthetics Recorder: Code injection when recording website with malicious contentAnalysed#1636382	Command and Code Injection	2023-04-08	–	47
CSRF in AppSearch allows creation of "curations"#1477050	Cross-Site Request Forgery	2022-11-17	–	35
RCE hazard in reporting (via Chromium)#1168765	Access Control	2021-05-26	$10,000	25
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access#1218680	Access Control	2021-08-03	–	21
Remote Code Execution in coming Kibana 7.7.0#861744	Access Control	2021-04-19	$5,000	14
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528	Access Control	2021-06-02	–	13

Subdomains19,861

Root:found.io

Scope

Name suggests:Development

First seen

Text fileClear filters10 names

Subdomains of Elastic
Name	Scope	First seen
cca-dev.apm.ap-southeast-1.aws.found.iodev, monitoring	In scope	2026-11-14
localhost.08a4b6741ef74411861c4ebdc3778dd2.eu-west-1.aws.found.iodev	In scope	2026-11-14
localhost.3d0334344904476489c28c1409785367.us-east-1.aws.found.iodev	In scope	2026-11-14
localhost.92e0c3d7c8cc402c9bdaf991f01f4947.us-east-1.aws.found.iodev	In scope	2026-11-14
localhost.94abc9318c712977e8c684628aa5ea0f.us-east-1.aws.found.iodev	In scope	2026-11-14
localhost.94d14580c84498d4ae3324d6d1b1737d.eu-west-1.aws.found.iodev	In scope	2026-11-14
localhost.c6a29e4e97f18ea128db0e27212af836.eu-west-1.aws.found.iodev	In scope	2026-11-14
localhost.c6c417b6a13caeefa7b3af7fba2b2dcc.eu-west-1.aws.found.iodev	In scope	2026-11-14
localhost.c788b048cd80925b684705c84ac61e57.us-east-1.aws.found.iodev	In scope	2026-11-14
localhost.c8aea3d6823809ce0d11dffa88f12018.eu-west-1.aws.found.iodev	In scope	2026-11-14

17,372 names are covered by the program's own scope; 5 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.