Bug bounty program

Elastic

Platform: HackerOne
Bounties: Pays
Assets in scope: 34
Disclosed reports: 14
Subdomains: 19,861
Vendor on CyberSIXT: Elastic (415 CVEs, 3 exploited)

Most upvoted reports14

Most upvoted reports of Elastic
Report	Weakness	Disclosed	Bounty	Votes
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398	Cross-site Scripting	2021-08-16	–	157
CVE-2021-40870 on [52.204.160.31]Analysed#1356845	Command and Code Injection	2021-10-06	–	75
Critical \|\| Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employeeAnalysed#1266188	Cryptography	2021-09-01	–	64
blind Server-Side Request Forgery (SSRF) allows scanning internal portsAnalysed#1300585	Server-Side Request Forgery	2023-05-05	–	54
Synthetics Recorder: Code injection when recording website with malicious contentAnalysed#1636382	Command and Code Injection	2023-04-08	–	47
CSRF in AppSearch allows creation of "curations"#1477050	Cross-Site Request Forgery	2022-11-17	–	35
RCE hazard in reporting (via Chromium)#1168765	Access Control	2021-05-26	$10,000	25
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access#1218680	Access Control	2021-08-03	–	21
Remote Code Execution in coming Kibana 7.7.0#861744	Access Control	2021-04-19	$5,000	14
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528	Access Control	2021-06-02	–	13

Subdomains19,861

Root

Scope

Name suggests:Internal

First seen

Text fileClear filters16 names

Subdomains of Elastic
Name	Scope	First seen
elasticsearch-benchmarks-internal.elastic.codata, internal	In scope	2026-11-14
internal-ci.elastic.coci, internal	In scope	2026-11-14
www.internal-ci.elastic.coci, internal	In scope	2026-11-14
internal-jira.elastic.cointernal, tools	In scope	2026-11-14
kibana-internal.elastic.cointernal, monitoring	In scope	2026-11-14
oauth-proxy-internal.elastic.coauth, internal	In scope	2026-11-14
internal-ci-master.elastic-ci-prod.us-central1-a.gcp.elasticnet.coci, data, internal	In scope	2026-11-14
argo-wf-qa-awseuw1-cp-internal-app-1.qa.cld.elstc.coci, internal, test	In scope	2026-11-14
argo-wf-qa-awseuw1-cp-internal-app-2.qa.cld.elstc.coci, internal, test	In scope	2026-11-14
argo-wf-qa-awseuw1-cp-internal-app-3.qa.cld.elstc.coci, internal, test	In scope	2026-11-14
argo-wf-qa-awseuw1-cp-internal-app-4.qa.cld.elstc.coci, internal, test	In scope	2026-11-14
argo-wf-qa-gcpusc1-cp-internal-app-1.qa.cld.elstc.coci, internal, test	In scope	2026-11-14
argo-wf-stg-awsuse1-cp-internal-app-1.staging.cld.elstc.coci, internal, staging	In scope	2026-11-14
argo-wf-stg-awsuse1-cp-internal-app-2.staging.cld.elstc.coci, internal, staging	In scope	2026-11-14
argo-wf-stg-gcpusc1-cp-internal-app-1.staging.cld.elstc.coci, internal, staging	In scope	2026-11-14
intranet.swiftype.cominternal	Listed out of scope	2026-11-14

17,372 names are covered by the program's own scope; 5 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.