Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| "Self" DOS with large deployment and scaling#831654 | N/A | Denial of Service | Low | 2020-07-23 | – | 2 |
| API Server DoS (crash?) if many large resources (~1MB each) are concurrently/repeatedly sent to an external Validating WebHook endpoint#1096907 | Informative | Denial of Service | Medium | 2021-04-01 | – | 2 |
| DoS for GCSArtifact.RealAll#833856 | Valid | Denial of Service | Medium | 2021-02-04 | – | 4 |
| DoS for client-go jsonpath func#882923 | Valid | Denial of Service | Low | 2020-07-24 | – | 6 |
| Kubelet resource exhaustion attack via metric label cardinality explosion from unauthenticated requests#774896 | Valid | Denial of Service | Medium | 2020-10-31 | – | 9 |
| Node disk DOS by writing to container /etc/hostsAnalysed#867699 | Valid | Denial of Service | Medium | 2020-07-22 | $1,000 | 161 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.