Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
34
Disclosed reports
14
Subdomains
19,861
Vendor on CyberSIXT
Elastic (415 CVEs, 3 exploited)

Most upvoted reports14

All reports
Most upvoted reports of Elastic
ReportWeaknessDisclosedBountyVotes
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398Cross-site Scripting2021-08-16–157
CVE-2021-40870 on [52.204.160.31]Analysed#1356845Command and Code Injection2021-10-06–75
Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employeeAnalysed#1266188Cryptography2021-09-01–64
blind Server-Side Request Forgery (SSRF) allows scanning internal portsAnalysed#1300585Server-Side Request Forgery2023-05-05–54
Synthetics Recorder: Code injection when recording website with malicious contentAnalysed#1636382Command and Code Injection2023-04-08–47
CSRF in AppSearch allows creation of "curations"Analysed#1477050Cross-Site Request Forgery2022-11-17–35
RCE hazard in reporting (via Chromium)Analysed#1168765Access Control2021-05-26$10,00025
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine AccessAnalysed#1218680Access Control2021-08-03–21
Remote Code Execution in coming Kibana 7.7.0#861744Access Control2021-04-19$5,00014
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528Access Control2021-06-02–13

Subdomains19,861

Subdomains of Elastic
NameScopeFirst seen
app-search.psc.europe-north1.gcp.elastic-cloud.comNot in the scope2026-11-14
ent.psc.europe-north1.gcp.elastic-cloud.comNot in the scope2026-11-14
ent-search.psc.europe-north1.gcp.elastic-cloud.comNot in the scope2026-11-14
es.psc.europe-north1.gcp.elastic-cloud.comNot in the scope2026-11-14
fleet.psc.europe-north1.gcp.elastic-cloud.comNot in the scope2026-11-14
kb.psc.europe-north1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.symbols.europe-north1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.europe-north1.gcp.elastic-cloud.comNot in the scope2026-11-14
europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
apm.europe-west1.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
wildcard.apm.europe-west1.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
app-search.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.app-search.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
ent.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
ent-search.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.ent-search.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.ent.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
es.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.es.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
fleet.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.fleet.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
ingest.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
kb.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.kb.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
profiling.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.profiling.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
psc.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
apm.psc.europe-west1.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
app-search.psc.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
ent.psc.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
ent-search.psc.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
es.psc.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
fleet.psc.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
kb.psc.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
symbols.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.symbols.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.europe-west1.gcp.elastic-cloud.comNot in the scope2026-11-14
europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
38c659809f494a08979854d9f619ee79.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
apm.europe-west2.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
mpb-production-elk.apm.europe-west2.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
rightmove-rum-apm.apm.europe-west2.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
wildcard.apm.europe-west2.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
app-search.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.app-search.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
ent.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
ent-search.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.ent-search.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.ent.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
es.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
vdf-contentful.es.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.es.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
fleet.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.fleet.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
ingest.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
kb.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
hcs.kb.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.kb.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.profiling.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
psc.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
apm.psc.europe-west2.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
app-search.psc.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
ent.psc.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
ent-search.psc.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
es.psc.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
fleet.psc.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
kb.psc.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.symbols.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.europe-west2.gcp.elastic-cloud.comNot in the scope2026-11-14
europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
apm.europe-west3.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
wildcard.apm.europe-west3.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
app-search.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.app-search.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
ent.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
ent-search.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.ent-search.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.ent.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
es.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.es.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
fleet.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.fleet.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
ingest.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
kb.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.kb.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.profiling.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
psc.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
apm.psc.europe-west3.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
app-search.psc.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
ent.psc.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
ent-search.psc.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
es.psc.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
fleet.psc.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
kb.psc.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.symbols.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
wildcard.europe-west3.gcp.elastic-cloud.comNot in the scope2026-11-14
europe-west4.gcp.elastic-cloud.comNot in the scope2026-11-14
27744cc57d384974baaa3785171b1233.europe-west4.gcp.elastic-cloud.comNot in the scope2026-11-14
apm.europe-west4.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14
736711b99e8b483b8039b782905325a6.apm.europe-west4.gcp.elastic-cloud.commonitoringNot in the scope2026-11-14

17,372 names are covered by the program's own scope; 5 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.