Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
34
Disclosed reports
14
Subdomains
19,861
Vendor on CyberSIXT
Elastic (415 CVEs, 3 exploited)

Most upvoted reports14

All reports
Most upvoted reports of Elastic
ReportWeaknessDisclosedBountyVotes
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398Cross-site Scripting2021-08-16–157
CVE-2021-40870 on [52.204.160.31]Analysed#1356845Command and Code Injection2021-10-06–75
Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employeeAnalysed#1266188Cryptography2021-09-01–64
blind Server-Side Request Forgery (SSRF) allows scanning internal portsAnalysed#1300585Server-Side Request Forgery2023-05-05–54
Synthetics Recorder: Code injection when recording website with malicious contentAnalysed#1636382Command and Code Injection2023-04-08–47
CSRF in AppSearch allows creation of "curations"#1477050Cross-Site Request Forgery2022-11-17–35
RCE hazard in reporting (via Chromium)#1168765Access Control2021-05-26$10,00025
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access#1218680Access Control2021-08-03–21
Remote Code Execution in coming Kibana 7.7.0#861744Access Control2021-04-19$5,00014
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528Access Control2021-06-02–13

Subdomains19,861

Subdomains of Elastic
NameScopeFirst seen
scythe-dev.kb.us-east-2.aws.elastic-cloud.comdevNot in the scope2026-11-14
adl-common-mfaf-dev.kb.japaneast.azure.elastic-cloud.comdevNot in the scope2026-11-14
cloud-dev.elastic.codevIn scope2026-11-14
dev.demo.elastic.codev, testIn scope2026-11-14
helm-dev.elastic.codevIn scope2026-11-14
kibitka-outdoometry-dev.elastic.codevIn scope2026-11-14
email.email.license-development.elastic.codevIn scope2026-11-14
oss-dependencies-dev.elastic.codevIn scope2026-11-14
dev-api.atlas.sa.elastic.coapi, devIn scope2026-11-14
demo-kibana-dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
dev.sa.elastic.codevIn scope2026-11-14
dev-atlas.sa.elastic.codevIn scope2026-11-14
catsize.dev.sa.elastic.codevIn scope2026-11-14
demo.dev.sa.elastic.codev, testIn scope2026-11-14
demo-kibana.dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
sa-demo-apachelogs.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-arcsight.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-cyclops.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-cyclops-kibana.dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
sa-demo-ece.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-honeypot-kibana.dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
sa-demo-kibana.dev.sa.elastic.codev, monitoring, testIn scope2026-11-14
sa-demo-ml.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-operations.dev.sa.elastic.codev, testIn scope2026-11-14
sa-demo-security.dev.sa.elastic.codev, testIn scope2026-11-14
embeddings-dev.sa.elastic.codevIn scope2026-11-14
telemetry-dev.elastic.codevIn scope2026-11-14
kibana.telemetry-dev.elastic.codev, monitoringIn scope2026-11-14
plumbers-ci-master.elastic-ci-dev.us-central1-a.gcp.elasticnet.coci, data, devIn scope2026-11-14
cd.argo.dev.inf.elasticnet.coci, devIn scope2026-11-14
events.argo.dev.inf.elasticnet.coci, devIn scope2026-11-14
workflow.argo.dev.inf.elasticnet.coci, devIn scope2026-11-14
es.chris-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
fleet.chris-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
kibana.chris-test.dev.inf.elasticnet.codev, monitoring, testIn scope2026-11-14
kibana-app.chris-test.dev.inf.elasticnet.codev, monitoring, testIn scope2026-11-14
spider.chris-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
spider-as.chris-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
terraform-lab.chris-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
coalfire-ece-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
admin.coalfire-ece-test.dev.inf.elasticnet.coadmin, dev, testIn scope2026-11-14
pentest.coalfire-ece-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
admin.coalfire-ece.dev.inf.elasticnet.coadmin, devIn scope2026-11-14
b94caa8f314b406eb736cb704927ecbe.coalfire-ece.dev.inf.elasticnet.codevIn scope2026-11-14
coalfire-test.coalfire-ece.dev.inf.elasticnet.codev, testIn scope2026-11-14
d4731d6da7234f348161c2373130e316.coalfire-ece.dev.inf.elasticnet.codevIn scope2026-11-14
coalfire.es.coalfire-ece.dev.inf.elasticnet.codevIn scope2026-11-14
coalfire.kb.coalfire-ece.dev.inf.elasticnet.codevIn scope2026-11-14
es.coalfire-eck-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
kibana.coalfire-eck-test.dev.inf.elasticnet.codev, monitoring, testIn scope2026-11-14
cortex-xsoar.dev.inf.elasticnet.codevIn scope2026-11-14
api.cortex-xsoar.dev.inf.elasticnet.coapi, devIn scope2026-11-14
draal.dev.inf.elasticnet.codevIn scope2026-11-14
es.draal.dev.inf.elasticnet.codevIn scope2026-11-14
kibana.draal.dev.inf.elasticnet.codev, monitoringIn scope2026-11-14
erat.dev.inf.elasticnet.codevIn scope2026-11-14
mcp-gateway.dev.inf.elasticnet.codevIn scope2026-11-14
mcp-portal.dev.inf.elasticnet.codevIn scope2026-11-14
app.misp.dev.inf.elasticnet.codevIn scope2026-11-14
login.all.oauth.dev.inf.elasticnet.coauth, devIn scope2026-11-14
login.oauth.dev.inf.elasticnet.coauth, devIn scope2026-11-14
api-admin.opa.dev.inf.elasticnet.coadmin, api, devIn scope2026-11-14
api-query.opa.dev.inf.elasticnet.coapi, devIn scope2026-11-14
opencti.dev.inf.elasticnet.codevIn scope2026-11-14
es.opencti.dev.inf.elasticnet.codevIn scope2026-11-14
kibana.opencti.dev.inf.elasticnet.codev, monitoringIn scope2026-11-14
kibana-app.opencti.dev.inf.elasticnet.codev, monitoringIn scope2026-11-14
repo-scan-api.dev.inf.elasticnet.coapi, dev, gitIn scope2026-11-14
security-shepherd.dev.inf.elasticnet.codevIn scope2026-11-14
soc2-watermark.dev.inf.elasticnet.codevIn scope2026-11-14
argo.spencer-argo-test.dev.inf.elasticnet.coci, dev, testIn scope2026-11-14
argo-api.spencer-argo-test.dev.inf.elasticnet.coapi, ci, dev, testIn scope2026-11-14
argocd.spencer-argo-test.dev.inf.elasticnet.coci, dev, testIn scope2026-11-14
es.spencer-eck-test-ccs.dev.inf.elasticnet.codev, testIn scope2026-11-14
kibana.spencer-eck-test-ccs.dev.inf.elasticnet.codev, monitoring, testIn scope2026-11-14
kibana-app.spencer-eck-test-ccs.dev.inf.elasticnet.codev, monitoring, testIn scope2026-11-14
apm.spencer-eck-test.dev.inf.elasticnet.codev, monitoring, testIn scope2026-11-14
es.spencer-eck-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
es-gke.spencer-eck-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
helloworld.spencer-eck-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
kibana.spencer-eck-test.dev.inf.elasticnet.codev, monitoring, testIn scope2026-11-14
kibana-app.spencer-eck-test.dev.inf.elasticnet.codev, monitoring, testIn scope2026-11-14
kibana-gke.spencer-eck-test.dev.inf.elasticnet.codev, monitoring, testIn scope2026-11-14
oauth.spencer-eck-test.dev.inf.elasticnet.coauth, dev, testIn scope2026-11-14
pnr.spencer-eck-test.dev.inf.elasticnet.codev, testIn scope2026-11-14
es.dev.draal.inf.elasticnet.codevIn scope2026-11-14
kibana.dev.draal.inf.elasticnet.codev, monitoringIn scope2026-11-14
cloud-user-console-apm-server-dev.app.elstc.coadmin, dev, monitoringIn scope2026-11-14
dev-1127.app.elstc.codevIn scope2026-11-14
dev-11437.app.elstc.codevIn scope2026-11-14
dev-12383-videos-troubleshoot-before-refactor.app.elstc.codevIn scope2026-11-14
dev-12383-videos-ungated.app.elstc.codevIn scope2026-11-14
dev-12383-videos-ungated-b.app.elstc.codevIn scope2026-11-14
dev-12442-quotescarousel.app.elstc.codevIn scope2026-11-14
dev-1292.app.elstc.codevIn scope2026-11-14
dev-1295.app.elstc.codevIn scope2026-11-14
dev-12956-instruqt.app.elstc.codevIn scope2026-11-14
dev-13006-banner-title.app.elstc.codevIn scope2026-11-14
dev-13006-banner-variant-enable-developer-blue.app.elstc.codevIn scope2026-11-14
dev-13006-banner-variants.app.elstc.codevIn scope2026-11-14

17,372 names are covered by the program's own scope; 5 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.