Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
82
Disclosed reports
77
Subdomains
662
Vendor on CyberSIXT
Kubernetes (120 CVEs, 0 exploited)

Most upvoted reports77

All reports
Most upvoted reports of Kubernetes
ReportWeaknessDisclosedBountyVotes
Node disk DOS by writing to container /etc/hostsAnalysed#867699Denial of Service2020-07-22$1,000161
Injection in path parameter of Ingress-nginxAnalysed#2701701Command and Code Injection2026-03-07–91
elections.k8s.io uses weak session secret key, may place elections at riskAnalysed#1387366Cryptography2025-09-19$25086
Bypass validation parts in AWS IAM Authenticator for KubernetesAnalysed#1580493Authentication2023-05-25$2,50068
CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodesAnalysed#2231019Command and Code Injection2023-12-21$5,00067
Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioAnalysed#746000Authentication2020-11-29$25062
Ingress nginx annotation injection causes arbitrary command executionAnalysed#1728174Command and Code Injection2023-11-24$2,50057
Authenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespacesAnalysed#1249583Access Control2021-12-04–55
Privilege Escalation in kOps using GCE/GCP ProviderAnalysed#1842829Access Control2023-08-04$2,50052
SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30XAnalysed#1544133Server-Side Request Forgery2022-12-10$1,00051

Subdomains662

Subdomains of Kubernetes
NameScopeFirst seen
u003ek8s.gcr.ioNot in the scope2026-11-14
u003eus.gcr.ioNot in the scope2026-11-14
upload.gcr.iodataNot in the scope2026-11-14
us.gcr.ioNot in the scope2026-11-14
vk8s.gcr.ioNot in the scope2026-11-14
vpn.gcr.iovpnNot in the scope2026-11-14
wap.gcr.ioNot in the scope2026-11-14
web.gcr.ioNot in the scope2026-11-14
webconf.gcr.ioNot in the scope2026-11-14
webdisk.gcr.ioNot in the scope2026-11-14
webmail.gcr.iomailNot in the scope2026-11-14
whm.gcr.ioNot in the scope2026-11-14
wiki.gcr.iotoolsNot in the scope2026-11-14
wildcard.gcr.ioNot in the scope2026-11-14
wordpress.gcr.ioNot in the scope2026-11-14
wp.gcr.ioNot in the scope2026-11-14
ww1.gcr.ioNot in the scope2026-11-14
www.gcr.ioNot in the scope2026-11-14
www1.gcr.ioNot in the scope2026-11-14
www2.gcr.ioNot in the scope2026-11-14
x22eu.gcr.ioNot in the scope2026-11-14
xn--imagerepositoryk8s-5u44ak86uvuihz0g4sbpz1tgcl4v5j.gcr.ioNot in the scope2026-11-14
xn--k8s-628dp2nm3azzu2ja3251b4jva.gcr.iotoolsNot in the scope2026-11-14
xn--pullk8s-rw3kf9duyna3410cna812q9p7ckt7e.gcr.ioNot in the scope2026-11-14
xn--tagk8s-hp7itmt4klucfxokr6a8ms4k9c2jwefwta.gcr.ioNot in the scope2026-11-14
dns-controller.addons.k8s.ioNot in the scope2026-11-14
admissionregistration.k8s.ioNot in the scope2026-11-14
apiextensions.k8s.ioNot in the scope2026-11-14
apiregistration.k8s.ioNot in the scope2026-11-14
flowcontrol.apiserver.k8s.ioNot in the scope2026-11-14
app.k8s.ioNot in the scope2026-11-14
apt.k8s.ioNot in the scope2026-11-14
legacy.apt.k8s.iolegacyNot in the scope2026-11-14
artifacts.k8s.ioNot in the scope2026-11-14
artifacts-sandbox.k8s.iotestNot in the scope2026-11-14
auditregistration.k8s.ioNot in the scope2026-11-14
auth.k8s.ioauthNot in the scope2026-11-14
authentication.k8s.ioNot in the scope2026-11-14
emptyclient.authentication.k8s.ioNot in the scope2026-11-14
existclient.authentication.k8s.ioNot in the scope2026-11-14
authorization.k8s.ioNot in the scope2026-11-14
rbac.authorization.k8s.ioNot in the scope2026-11-14
autoscaling.k8s.ioNot in the scope2026-11-14
internal.autoscaling.k8s.iointernalNot in the scope2026-11-14
blog.k8s.ioNot in the scope2026-11-14
bogus.k8s.ioNot in the scope2026-11-14
canary.k8s.iostagingNot in the scope2026-11-14
feature.canary.k8s.iostagingNot in the scope2026-11-14
dranet.sigs.canary.k8s.iostagingNot in the scope2026-11-14
kindnet.sigs.canary.k8s.iostagingNot in the scope2026-11-14
kube-network-policies.sigs.canary.k8s.iostaging, toolsNot in the scope2026-11-14
api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioapi, staging, testNot in the scope2026-11-14
delegateapi.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.iostaging, testNot in the scope2026-11-14
certificates.k8s.ioNot in the scope2026-11-14
certmanager.k8s.ioNot in the scope2026-11-14
admission.certmanager.k8s.ioNot in the scope2026-11-14
changelog.k8s.ioNot in the scope2026-11-14
cherrypick.k8s.ioNot in the scope2026-11-14
ci-test.k8s.ioci, testNot in the scope2026-11-14
cluster.k8s.ioNot in the scope2026-11-14
code.k8s.ioNot in the scope2026-11-14
codereview.k8s.ioNot in the scope2026-11-14
conduct.k8s.ioNot in the scope2026-11-14
coordination.k8s.ioNot in the scope2026-11-14
cp.k8s.ioNot in the scope2026-11-14
cs.k8s.ioNot in the scope2026-11-14
cs-canary.k8s.iostagingNot in the scope2026-11-14
devstats.k8s.ioNot in the scope2026-11-14
discovery.k8s.ioNot in the scope2026-11-14
discuss.k8s.ioNot in the scope2026-11-14
dl.k8s.ioNot in the scope2026-11-14
cdn.dl.k8s.ioNot in the scope2026-11-14
docs.k8s.ioNot in the scope2026-11-14
6y71-7.docs.k8s.ioNot in the scope2026-11-14
appv1-7.docs.k8s.ioNot in the scope2026-11-14
virus0316dev2-k8s-876543210z-www.27654.service.now.com2-logindevticketingfoia-dot-gov.appv1-7.docs.k8s.iodev, toolsNot in the scope2026-11-14
changelog-kootac-pay.docs.k8s.ioNot in the scope2026-11-14
virus0316com.changelog-kootac-pay.docs.k8s.ioNot in the scope2026-11-14
croatiaarter1-7.docs.k8s.ioNot in the scope2026-11-14
fr-kusanagiommunityaime-demo-kubectl.docs.k8s.iotestNot in the scope2026-11-14
antivirus1overi.fr-kusanagiommunityaime-demo-kubectl.docs.k8s.iotestNot in the scope2026-11-14
host-209-149-112-62.docs.k8s.ioNot in the scope2026-11-14
virus0316com.host-209-149-112-62.docs.k8s.ioNot in the scope2026-11-14
i43ubectl.docs.k8s.ioNot in the scope2026-11-14
www.virus-r80.i43ubectl.docs.k8s.ioNot in the scope2026-11-14
iobrbrjbr4-v1-7.docs.k8s.ioNot in the scope2026-11-14
antivirus1-ip151.docs.foru.iobrbrjbr4-v1-7.docs.k8s.ioNot in the scope2026-11-14
kubectl.docs.k8s.ioNot in the scope2026-11-14
antivirusexceptionsoztips.beta.billing.bid.redirect2.kubectl.docs.k8s.iostagingNot in the scope2026-11-14
mx225.docs.k8s.ioNot in the scope2026-11-14
virus0316com.mx225.docs.k8s.ioNot in the scope2026-11-14
sif1-7.docs.k8s.ioNot in the scope2026-11-14
www.virus.syndeowww.sif1-7.docs.k8s.ioNot in the scope2026-11-14
v1-7.docs.k8s.ioNot in the scope2026-11-14
www.antivirussistobrbrjbr-pwmbvigsvc.g.gi81.v1-7.docs.k8s.ioNot in the scope2026-11-14
virus0316ts-shanemancommunityaime-demo-kubectl.docs.k8s.iotestNot in the scope2026-11-14
elections.k8s.ioNot in the scope2026-11-14
error-on-deletedevents.k8s.ioNot in the scope2026-11-14
events.k8s.ioNot in the scope2026-11-14
examples.k8s.ioNot in the scope2026-11-14

2 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.