Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
elections.k8s.io uses weak session secret key, may place elections at riskAnalysed#1387366	Valid	Cryptography	High	2025-09-19	$250	86
Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioAnalysed#746000	Valid	Authentication	Medium	2020-11-29	$250	62
monitoring.prow-canary.k8s.io is vulnerable to CVE-2022-21703 (Grafana 0-day)Analysed#1466765	Valid	Cross-Site Request Forgery	Low	2024-06-25	$100	36
File Read Vulnerability allows Attackers to Compromise S3 buckets using ProwAnalysed#1485500	Valid	Access Control	Medium	2023-04-25	$250	26
Broken link hijacking in https://kubernetes-csi.github.io/docs/drivers.html?highlight=chubaofs#production-driversAnalysed#1466889	Valid	File and Path Handling	Low	2022-03-25	$100	18
Broken Domain Link Takeover from kubernetes.io docsAnalysed#1434179	Valid	File and Path Handling	Low	2022-04-03	$100	17
Github Account Takeover from Docs page of `kubernetes-csi.github.io`Analysed#1434967	Valid	Access Control	Low	2022-06-04	–	16
Google storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSSAnalysed#1398706	Valid	Access Control	Medium	2021-12-16	–	14

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.