Bug bounty program

Kubernetes

Platform: HackerOne
Bounties: Pays
Assets in scope: 82
Disclosed reports: 77
Subdomains: 662
Vendor on CyberSIXT: Kubernetes (120 CVEs, 0 exploited)

Most upvoted reports77

Most upvoted reports of Kubernetes
Report	Weakness	Disclosed	Bounty	Votes
Node disk DOS by writing to container /etc/hostsAnalysed#867699	Denial of Service	2020-07-22	$1,000	161
Injection in path parameter of Ingress-nginxAnalysed#2701701	Command and Code Injection	2026-03-07	–	91
elections.k8s.io uses weak session secret key, may place elections at riskAnalysed#1387366	Cryptography	2025-09-19	$250	86
Bypass validation parts in AWS IAM Authenticator for KubernetesAnalysed#1580493	Authentication	2023-05-25	$2,500	68
CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodesAnalysed#2231019	Command and Code Injection	2023-12-21	$5,000	67
Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioAnalysed#746000	Authentication	2020-11-29	$250	62
Ingress nginx annotation injection causes arbitrary command executionAnalysed#1728174	Command and Code Injection	2023-11-24	$2,500	57
Authenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespacesAnalysed#1249583	Access Control	2021-12-04	–	55
Privilege Escalation in kOps using GCE/GCP ProviderAnalysed#1842829	Access Control	2023-08-04	$2,500	52
SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30XAnalysed#1544133	Server-Side Request Forgery	2022-12-10	$1,000	51

Weaknesses of its reports

In scope

Source code72 assetsgithub.com/kubernetes-csi · github.com/kubernetes-retired · https://github.com/kubernetes-client · https://github.com/kubernetes-incubator · https://github.com/kubernetes-security · https://github.com/kubernetes-sigs · https://github.com/kubernetes/api · https://github.com/kubernetes/apiextensions-apiserver
Other assets6 assetsCommunity Management & Communications · Tier 1 · Tier 2 · Tier 3 · https://storage.googleapis.com/kubernetes-release/ · k8s.gcr.io
Web applications4 assetsk8s.io · kubernetes-csi.github.io · kubernetes.io · prow.k8s.io

Subdomains662

Root

Scope

Name suggests:Tools

First seen

Text fileClear filters25 names

Subdomains of Kubernetes
Name	Scope	First seen
k8s.gcr.iotools	In scope	2026-11-14
wiki.gcr.iotools	Not in the scope	2026-11-14
dl.k8s.gcr.iotools	Not in the scope	2026-11-14
docker.gcr.iotools	Not in the scope	2026-11-14
www.k8s.gcr.iotools	Not in the scope	2026-11-14
registry.gcr.iotools	Not in the scope	2026-11-14
kubernetes.gcr.iotools	Not in the scope	2026-11-14
k8s-staging.gcr.iostaging, tools	Not in the scope	2026-11-14
my-registry.gcr.iotools	Not in the scope	2026-11-14
rancher1k8s.gcr.iotools	Not in the scope	2026-11-14
staging-k8s.gcr.iostaging, tools	Not in the scope	2026-11-14
kube-apiserverk8s.gcr.iotools	Not in the scope	2026-11-14
fluentdstaging-k8s.gcr.iotools	Not in the scope	2026-11-14
kube-controller-managerk8s.gcr.iotools	Not in the scope	2026-11-14
xn--k8s-628dp2nm3azzu2ja3251b4jva.gcr.iotools	Not in the scope	2026-11-14
registry.k8s.iotools	Not in the scope	2026-11-14
cdn.registry.k8s.iotools	Not in the scope	2026-11-14
k8s-infra-prow.k8s.iotools	Not in the scope	2026-11-14
registry-sandbox.k8s.iotest, tools	Not in the scope	2026-11-14
kubernetes.submit-queue.k8s.iotools	Not in the scope	2026-11-14
kube-network-policies.sigs.k8s.iotools	Not in the scope	2026-11-14
k8s-infra-cdn-cf-sandbox-ame.k8s.iotest, tools	Not in the scope	2026-11-14
kube-agentic-networking.sigs.k8s.iotools	Not in the scope	2026-11-14
kube-network-policies.sigs.canary.k8s.iostaging, tools	Not in the scope	2026-11-14
virus0316dev2-k8s-876543210z-www.27654.service.now.com2-logindevticketingfoia-dot-gov.appv1-7.docs.k8s.iodev, tools	Not in the scope	2026-11-14

2 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.