Lack of Packet Sanitation in Goflow Results in Multiple DoS Attack Vectors and Bugs #1636320 Valid Denial of Service – 2022-09-30 $500 8 Bypass Cloudflare WARP lock on iOS. #1542450 Valid Input Validation and Logic – 2022-11-07 $500 10 Privilege escalation to root in Pages build image v2 #1979372 Valid Access Control – 2023-05-26 $350 10 Password Policy Restriction Bypass #1675730 Valid Misconfiguration and Insecure Design – 2022-09-30 – 11 Misconfigured build on websites "abuse.cloudflare.com" #1624911 Valid No weakness recorded – 2022-10-13 $100 12 Ability to bypass locked Cloudflare WARP on wifi networks. #1635748 Valid Input Validation and Logic – 2022-11-16 $1,000 12 Extraction of Pages build scripts, config values, tokens, etc. via symlinks #1754811 Valid Information Disclosure – 2023-03-06 $500 12 Session mismatch leading to potential account takeover (local access required) #1825227 Valid Insecure Direct Object Reference – 2023-04-10 – 16 Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts #1593413 Valid Authentication – 2022-06-27 $250 17 Bypassing creation of API tokens without email verification #1812705 Valid Authentication – 2023-03-27 – 19 I found another way to bypass Cloudflare Warp lock! #1605847 Valid Input Validation and Logic – 2022-11-07 $1,000 20 Completely remove VPN profile from locked WARP iOS cient. #1633231 Valid Input Validation and Logic – 2022-11-07 $1,000 21 Origin IP address disclosure through Pingora response header #1803659 Valid Information Disclosure – 2023-01-10 – 21 cd=false (DNSSEC) not respected in DNS over HTTPS JSON requests #1724464 Valid Input Validation and Logic – 2022-12-12 $250 23 Cloudflare is not properly deleting user's account #1728292 Valid Input Validation and Logic – 2023-04-13 – 23 YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.com #2174818 Informative Injection and Smuggling – 2023-11-10 – 24 Basic XSS [WAF Bypasses] #1615743 Informative No weakness recorded – 2023-07-07 $50 27 API docs expose an active token for the sample domain theburritobot.com #1507412 Valid Information Disclosure – 2022-06-27 $500 28 Take over subdomains of r2.dev using R2 custom domains #1700276 Valid No weakness recorded – 2022-09-28 $1,125 28 💥💥Crash report -Cloudflare WARP doesn't verify text length in "Excluded Host" name input data💥💥 #1781096 Valid Memory Corruption – 2023-07-31 – 29 Sign in with Apple works on existing accounts, bypasses 2FA #1593404 Valid Authentication – 2022-06-27 $1,000 32 A malicious actor could rotate tokens of a victim, given that he knows the victim's token ID #1525309 Valid Access Control – 2023-04-13 – 34 Bypass two-factor authentication #1664974 Valid Authentication – 2022-10-04 $250 34 Bypassing Cache Deception Armor using .avif extension file #1391635 Valid Information Disclosure – 2022-06-27 – 36 [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth #3321406 Valid No weakness recorded High 2026-04-14 – 39 Signup with any Email and Enable 2-FA without verifying Email #1543259 Valid Authentication – 2022-09-12 – 40 Arbitrary file read from Cloudflare Pages build environment #1570874 Valid No weakness recorded – 2024-02-23 – 40 Enable 2Fa verification without verifying email #1618021 Valid Access Control – 2022-08-31 – 40 Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seat #2122690 Valid Authentication – 2023-10-25 – 43 HTTP request smuggling with Origin Rules using newlines in the host_header action parameter #1575912 Valid Injection and Smuggling – 2022-06-27 $3,100 46 Any WARP User Can Access Organization-Specific Application #2802817 Informative Authentication None 2025-05-19 – 46 Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATO #3316910 Valid Cross-site Scripting Low 2025-12-16 – 50 Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfiguration #1467044 Valid Server-Side Request Forgery – 2022-08-31 – 54 HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers #3622877 Valid Access Control High 2026-09-14 $1,500 54 Bypass R2 payment screen #2170559 Valid Authentication – 2023-11-10 $350 57 AI Playground XSS to steal user-chat messages and access to connected MCP Server #3424998 Valid Cross-site Scripting Low 2026-02-26 – 62 [Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuth #3423950 Valid Cross-site Scripting High 2026-04-14 – 63 Yet Another CASB Integration Takeover of Active Integrations #2094346 Valid No weakness recorded – 2023-11-13 – 68 `use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using it #3211031 Valid Cross-site Scripting Medium 2025-09-30 $550 75 Hijack all emails sent to any domain that uses Cloudflare Email Forwarding #1419341 Valid Access Control – 2022-07-28 $6,000 76 Bypass of Cloudflare's Cache Keys and WAF via header overflow #3027461 Valid Access Control High 2025-11-18 – 77 Using special IPv4-mapped IPv6 addresses to bypass local IP ban #1785260 Valid No weakness recorded – 2023-01-24 $7,500 78 Cloudflare CASB Confused Deputy Problem #1952124 Valid No weakness recorded – 2023-06-07 $3,300 97 HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() function #1478633 Valid Injection and Smuggling – 2022-05-16 $6,000 116