Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
34
Disclosed reports
14
Subdomains
19,861
Vendor on CyberSIXT
Elastic (415 CVEs, 3 exploited)

Most upvoted reports14

All reports
Most upvoted reports of Elastic
ReportWeaknessDisclosedBountyVotes
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398Cross-site Scripting2021-08-16–157
CVE-2021-40870 on [52.204.160.31]Analysed#1356845Command and Code Injection2021-10-06–75
Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employeeAnalysed#1266188Cryptography2021-09-01–64
blind Server-Side Request Forgery (SSRF) allows scanning internal portsAnalysed#1300585Server-Side Request Forgery2023-05-05–54
Synthetics Recorder: Code injection when recording website with malicious contentAnalysed#1636382Command and Code Injection2023-04-08–47
CSRF in AppSearch allows creation of "curations"Analysed#1477050Cross-Site Request Forgery2022-11-17–35
RCE hazard in reporting (via Chromium)Analysed#1168765Access Control2021-05-26$10,00025
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine AccessAnalysed#1218680Access Control2021-08-03–21
Remote Code Execution in coming Kibana 7.7.0#861744Access Control2021-04-19$5,00014
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528Access Control2021-06-02–13

Subdomains19,861

Subdomains of Elastic
NameScopeFirst seen
console.ece-demo.elastic.coadmin, testIn scope2026-11-14
admin.intotheindex.elastic.coadminIn scope2026-11-14
admin.coalfire-ece-test.dev.inf.elasticnet.coadmin, dev, testIn scope2026-11-14
admin.coalfire-ece.dev.inf.elasticnet.coadmin, devIn scope2026-11-14
api-admin.opa.dev.inf.elasticnet.coadmin, api, devIn scope2026-11-14
console.starfury.inf.elasticnet.coadminIn scope2026-11-14
admin-search-loco-togo.app.elstc.coadminIn scope2026-11-14
cloud-user-console-apm-server.app.elstc.coadmin, monitoringIn scope2026-11-14
cloud-user-console-apm-server-dev.app.elstc.coadmin, dev, monitoringIn scope2026-11-14
dev-cms-redirect.app.elstc.coadmin, devIn scope2026-11-14
release-sanity-cms-migration.app.elstc.coadminIn scope2026-11-14
release-sanity-migration-cms.app.elstc.coadminIn scope2026-11-14
sitemap-manager.app.elstc.coadminIn scope2026-11-14
foobar.igor-cert-manager-test.dev.cld.elstc.coadmin, dev, testIn scope2026-11-14
foobar10.igor-cert-manager-test.dev.cld.elstc.coadmin, dev, testIn scope2026-11-14
foobar11.igor-cert-manager-test.dev.cld.elstc.coadmin, dev, testIn scope2026-11-14
foobar2.igor-cert-manager-test.dev.cld.elstc.coadmin, dev, testIn scope2026-11-14
foobar3.igor-cert-manager-test.dev.cld.elstc.coadmin, dev, testIn scope2026-11-14
foobar5.igor-cert-manager-test.dev.cld.elstc.coadmin, dev, testIn scope2026-11-14
admin.qa.cld.elstc.coadmin, testIn scope2026-11-14
auto-ops.admin.qa.cld.elstc.coadmin, testIn scope2026-11-14
app.auto-ops.admin.qa.cld.elstc.coadmin, testIn scope2026-11-14
application-tls-test.auto-ops.admin.qa.cld.elstc.coadmin, testIn scope2026-11-14
auto-ops.eu-west-1.aws.admin.qa.cld.elstc.coadmin, testIn scope2026-11-14
api.auto-ops.eu-west-1.aws.admin.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api-mtls.auto-ops.eu-west-1.aws.admin.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api-tls-test.auto-ops.eu-west-1.aws.admin.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api.auto-ops.eastus2.azure.admin.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api-mtls.auto-ops.eastus2.azure.admin.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api.auto-ops.us-central1.gcp.admin.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api-mtls.auto-ops.us-central1.gcp.admin.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
console.qa.cld.elstc.coadmin, testIn scope2026-11-14
console-heroku.qa.cld.elstc.coadmin, testIn scope2026-11-14
auto-ops.console.qa.cld.elstc.coadmin, testIn scope2026-11-14
application-tls-test.auto-ops.console.qa.cld.elstc.coadmin, testIn scope2026-11-14
auto-ops.eu-west-1.aws.console.qa.cld.elstc.coadmin, testIn scope2026-11-14
api.auto-ops.eu-west-1.aws.console.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api-mtls.auto-ops.eu-west-1.aws.console.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api-tls-test.auto-ops.eu-west-1.aws.console.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
otel-collector.auto-ops.eu-west-1.aws.console.qa.cld.elstc.coadmin, testIn scope2026-11-14
api.auto-ops.eastus2.azure.console.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api-mtls.auto-ops.eastus2.azure.console.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api.auto-ops.us-central1.gcp.console.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
api-mtls.auto-ops.us-central1.gcp.console.qa.cld.elstc.coadmin, api, testIn scope2026-11-14
otel-collector.auto-ops.us-central1.gcp.console.qa.cld.elstc.coadmin, testIn scope2026-11-14
console.gcp.qa.cld.elstc.coadmin, testIn scope2026-11-14
admin.global.qa.cld.elstc.coadmin, testIn scope2026-11-14
otel-collector.auto-ops.eu-central-1.aws.console.staging.cld.elstc.coadmin, stagingIn scope2026-11-14
otel-collector.auto-ops.us-east-1.aws.console.staging.cld.elstc.coadmin, stagingIn scope2026-11-14
admin.global.staging.cld.elstc.coadmin, stagingIn scope2026-11-14
new-cert-manager-config.micky-test.ea-es.elstc.coadmin, testIn scope2026-11-14
admin-ccr.prod-emea.eden.elstc.coadminIn scope2026-11-14
admin.eu-west-1.aws.found.ioadminIn scope2026-11-14

17,372 names are covered by the program's own scope; 5 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.