Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
82
Disclosed reports
77
Subdomains
662
Vendor on CyberSIXT
Kubernetes (120 CVEs, 0 exploited)

Most upvoted reports77

All reports
Most upvoted reports of Kubernetes
ReportWeaknessDisclosedBountyVotes
Node disk DOS by writing to container /etc/hostsAnalysed#867699Denial of Service2020-07-22$1,000161
Injection in path parameter of Ingress-nginxAnalysed#2701701Command and Code Injection2026-03-07–91
elections.k8s.io uses weak session secret key, may place elections at riskAnalysed#1387366Cryptography2025-09-19$25086
Bypass validation parts in AWS IAM Authenticator for KubernetesAnalysed#1580493Authentication2023-05-25$2,50068
CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodesAnalysed#2231019Command and Code Injection2023-12-21$5,00067
Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioAnalysed#746000Authentication2020-11-29$25062
Ingress nginx annotation injection causes arbitrary command executionAnalysed#1728174Command and Code Injection2023-11-24$2,50057
Authenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespacesAnalysed#1249583Access Control2021-12-04–55
Privilege Escalation in kOps using GCE/GCP ProviderAnalysed#1842829Access Control2023-08-04$2,50052
SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30XAnalysed#1544133Server-Side Request Forgery2022-12-10$1,00051

Subdomains662

Subdomains of Kubernetes
NameScopeFirst seen
api.gcr.ioapiNot in the scope2026-11-14
cim-api.gcr.ioapiNot in the scope2026-11-14
cim-api-qa.gcr.ioapi, testNot in the scope2026-11-14
cim-api-dev.gcr.ioapi, devNot in the scope2026-11-14
cim-api-uat.gcr.ioapi, testNot in the scope2026-11-14
cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
gateway-api.sigs.k8s.ioapiNot in the scope2026-11-14
cluster-api-aws.sigs.k8s.ioapiNot in the scope2026-11-14
cluster-api-gcp.sigs.k8s.ioapiNot in the scope2026-11-14
tip.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
main.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
main.gateway-api.sigs.k8s.ioapiNot in the scope2026-11-14
master.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
network-policy-api.sigs.k8s.ioapiNot in the scope2026-11-14
cluster-api-ibmcloud.sigs.k8s.ioapiNot in the scope2026-11-14
cluster-api-operator.sigs.k8s.ioapiNot in the scope2026-11-14
v1alpha1.cluster-api.sigs.k8s.ioapi, stagingNot in the scope2026-11-14
cluster-api-openstack.sigs.k8s.ioapiNot in the scope2026-11-14
cluster-api-cloudstack.sigs.k8s.ioapiNot in the scope2026-11-14
release-0-1.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-0-2.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-0-3.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-0-4.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-0.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-1.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-2.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-3.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-4.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-5.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-6.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-7.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-8.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-9.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-10.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-11.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-12.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-13.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
release-1-14.cluster-api.sigs.k8s.ioapiNot in the scope2026-11-14
main.cluster-api-ibmcloud.sigs.k8s.ioapiNot in the scope2026-11-14
gateway-api-inference-extension.sigs.k8s.ioapiNot in the scope2026-11-14
release-0-3.cluster-api-ibmcloud.sigs.k8s.ioapiNot in the scope2026-11-14
release-0-4.cluster-api-ibmcloud.sigs.k8s.ioapiNot in the scope2026-11-14
release-0-5.cluster-api-ibmcloud.sigs.k8s.ioapiNot in the scope2026-11-14
release-0-6.cluster-api-ibmcloud.sigs.k8s.ioapiNot in the scope2026-11-14
release-0-7.cluster-api-ibmcloud.sigs.k8s.ioapiNot in the scope2026-11-14
api.e2e-0b558396e7-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-0e3b3b105e-51e6f.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-119d4bce7f-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-2a1210d242-167d8.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-2f38f331a5-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-335a350845-82393.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-3b069ed03f-3bdeb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-4386ba2b8b-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-48c3e7466b-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-52299a2419-167d8.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-6443a68b84-51e6f.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-752a644b67-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-7530df1184-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-78945a0dd8-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-78e37db369-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-8626c578fa-167d8.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-87a41f769c-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-903bce6b17-82393.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-9204b62fe8-82393.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-9b4c150ca1-3bdeb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-a1bee8b4b9-51e6f.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-a4cf1bad8d-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-a8ded46cc5-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-bcd6bf0425-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-c040dd4db7-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-c2b9a690a3-167d8.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-d0e1908200-82393.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-d2776fe574-82393.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-dda82cbc91-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-de41e3ce3a-51e6f.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-e0626a3170-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-e253554a42-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-f3f156c7a5-51e6f.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
api.e2e-ffa700880e-ff1eb.test-cncf-aws.k8s.ioapi, testNot in the scope2026-11-14
release-0-12.cluster-api-ibmcloud.sigs.k8s.ioapiNot in the scope2026-11-14
api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioapi, staging, testNot in the scope2026-11-14
api.internal.e2e-kops-aws-canary.test-cncf-aws.k8s.ioapi, internal, staging, testNot in the scope2026-11-14
api.internal.scale-1000.periodic.test-cncf-aws.k8s.ioapi, internal, testNot in the scope2026-11-14
api.internal.scale-5000.periodic.test-cncf-aws.k8s.ioapi, internal, testNot in the scope2026-11-14

2 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.