Skip to content
Connect AISign inSign up free

Bug bounty program

KU

Kubernetes

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
82
Disclosed reports
77
Subdomains
662
Vendor on CyberSIXT
Kubernetes (120 CVEs, 0 exploited)

Most upvoted reports77

All reports
Most upvoted reports of Kubernetes
ReportWeaknessDisclosedBountyVotes
Node disk DOS by writing to container /etc/hostsAnalysed#867699Denial of Service2020-07-22$1,000161
Injection in path parameter of Ingress-nginxAnalysed#2701701Command and Code Injection2026-03-07–91
elections.k8s.io uses weak session secret key, may place elections at riskAnalysed#1387366Cryptography2025-09-19$25086
Bypass validation parts in AWS IAM Authenticator for KubernetesAnalysed#1580493Authentication2023-05-25$2,50068
CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodesAnalysed#2231019Command and Code Injection2023-12-21$5,00067
Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioAnalysed#746000Authentication2020-11-29$25062
Ingress nginx annotation injection causes arbitrary command executionAnalysed#1728174Command and Code Injection2023-11-24$2,50057
Authenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespacesAnalysed#1249583Access Control2021-12-04–55
Privilege Escalation in kOps using GCE/GCP ProviderAnalysed#1842829Access Control2023-08-04$2,50052
SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30XAnalysed#1544133Server-Side Request Forgery2022-12-10$1,00051

Subdomains662

Root
Scope
Name suggests
First seen
Text file662 names
Subdomains of Kubernetes
NameScopeFirst seen
kube-controller-managerk8s.gcr.iotoolsNot in the scope2026-11-14
kubernetes.gcr.iotoolsNot in the scope2026-11-14
l.gcr.ioNot in the scope2026-11-14
launcher.gcr.ioNot in the scope2026-11-14
lists.gcr.ioNot in the scope2026-11-14
liveupdate.gcr.ioNot in the scope2026-11-14
localhost.gcr.iodevNot in the scope2026-11-14
login.gcr.ioauthNot in the scope2026-11-14
m.gcr.ioNot in the scope2026-11-14
mail.gcr.iomailNot in the scope2026-11-14
mail1.gcr.iomailNot in the scope2026-11-14
mail2.gcr.iomailNot in the scope2026-11-14
mailserver.gcr.ioNot in the scope2026-11-14
marketplace.gcr.ioNot in the scope2026-11-14
masterk8s.gcr.ioNot in the scope2026-11-14
mbb.gcr.ioNot in the scope2026-11-14
mbk8s.gcr.ioNot in the scope2026-11-14
mdm.gcr.ioNot in the scope2026-11-14
media.gcr.ioNot in the scope2026-11-14
meet.gcr.ioNot in the scope2026-11-14
migrate.gcr.ioNot in the scope2026-11-14
mirror.gcr.ioNot in the scope2026-11-14
ml.gcr.ioNot in the scope2026-11-14
mobile.gcr.ioNot in the scope2026-11-14
mongo.gcr.iodataNot in the scope2026-11-14
mongodb.gcr.iodataNot in the scope2026-11-14
mssql.gcr.ioNot in the scope2026-11-14
mta-sts.gcr.ioNot in the scope2026-11-14
mx.gcr.iomailNot in the scope2026-11-14
mx01.gcr.ioNot in the scope2026-11-14
mx1.gcr.ioNot in the scope2026-11-14
mx2.gcr.ioNot in the scope2026-11-14
my-registry.gcr.iotoolsNot in the scope2026-11-14
mysql.gcr.iodataNot in the scope2026-11-14
namesb.gcr.ioNot in the scope2026-11-14
network.gcr.ioNot in the scope2026-11-14
networkpolicypeer.gcr.ioNot in the scope2026-11-14
networkpolicyspec.gcr.ioNot in the scope2026-11-14
new.gcr.ioNot in the scope2026-11-14
news.gcr.ioNot in the scope2026-11-14
nk8s.gcr.ioNot in the scope2026-11-14
ns.gcr.ioNot in the scope2026-11-14
ns1.gcr.ioNot in the scope2026-11-14
ns2.gcr.ioNot in the scope2026-11-14
ns3.gcr.ioNot in the scope2026-11-14
ns4.gcr.ioNot in the scope2026-11-14
object.gcr.ioNot in the scope2026-11-14
office.gcr.ioNot in the scope2026-11-14
old.gcr.iolegacyNot in the scope2026-11-14
outlook.gcr.ioNot in the scope2026-11-14
owa.gcr.iomailNot in the scope2026-11-14
pipek8s.gcr.ioNot in the scope2026-11-14
pointerk8s.gcr.ioNot in the scope2026-11-14
pop.gcr.ioNot in the scope2026-11-14
pop3.gcr.iomailNot in the scope2026-11-14
portal.gcr.ioNot in the scope2026-11-14
postmaster.gcr.ioNot in the scope2026-11-14
preview.gcr.iostagingNot in the scope2026-11-14
product.gcr.ioNot in the scope2026-11-14
projectk8s.gcr.ioNot in the scope2026-11-14
proxy.gcr.ioNot in the scope2026-11-14
pruneinterruptedisobjectendjobtemplatek8s.gcr.ioNot in the scope2026-11-14
qk8s.gcr.ioNot in the scope2026-11-14
rancher1k8s.gcr.iotoolsNot in the scope2026-11-14
registry.gcr.iotoolsNot in the scope2026-11-14
remote.gcr.iovpnNot in the scope2026-11-14
root.gcr.ioNot in the scope2026-11-14
s.gcr.ioNot in the scope2026-11-14
sap.gcr.ioNot in the scope2026-11-14
scannerk8s.gcr.ioNot in the scope2026-11-14
search.gcr.ioNot in the scope2026-11-14
search-dev.gcr.iodevNot in the scope2026-11-14
searchportal.gcr.ioNot in the scope2026-11-14
searchportal-dev.gcr.iodevNot in the scope2026-11-14
secure.gcr.ioNot in the scope2026-11-14
server.gcr.ioNot in the scope2026-11-14
server1.gcr.ioNot in the scope2026-11-14
shop.gcr.ioNot in the scope2026-11-14
signsasia.gcr.ioNot in the scope2026-11-14
sip.gcr.ioNot in the scope2026-11-14
sizek8s.gcr.ioNot in the scope2026-11-14
sk8s.gcr.ioNot in the scope2026-11-14
smtp.gcr.iomailNot in the scope2026-11-14
something.gcr.ioNot in the scope2026-11-14
ssl.gcr.ioNot in the scope2026-11-14
sslvpn.gcr.iovpnNot in the scope2026-11-14
stage.gcr.iostagingNot in the scope2026-11-14
staging.gcr.iostagingNot in the scope2026-11-14
staging-k8s.gcr.iostaging, toolsNot in the scope2026-11-14
static.gcr.ioNot in the scope2026-11-14
stats.gcr.ioNot in the scope2026-11-14
store.gcr.ioNot in the scope2026-11-14
streamk8s.gcr.ioNot in the scope2026-11-14
stringk8s.gcr.ioNot in the scope2026-11-14
support.gcr.ioNot in the scope2026-11-14
test.gcr.iotestNot in the scope2026-11-14
tools.gcr.ioNot in the scope2026-11-14
u003easia.gcr.ioNot in the scope2026-11-14
u003eb.gcr.ioNot in the scope2026-11-14
u003eeu.gcr.ioNot in the scope2026-11-14

2 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated