Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
44 of 15,219 reports · $36,675 in bounties · 161 analysed so far
- #1478633ValidHTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() functionCloudflare Public Bug Bounty · Injection and Smuggling · 2022$6,000116votes
- #1952124ValidCloudflare CASB Confused Deputy ProblemCloudflare Public Bug Bounty · No weakness recorded · 2023$3,30097votes
- #1785260ValidUsing special IPv4-mapped IPv6 addresses to bypass local IP banCloudflare Public Bug Bounty · No weakness recorded · 2023$7,50078votes
- #3027461ValidBypass of Cloudflare's Cache Keys and WAF via header overflowCloudflare Public Bug Bounty · Access Control · 2025 · High–77votes
- #1419341ValidHijack all emails sent to any domain that uses Cloudflare Email ForwardingCloudflare Public Bug Bounty · Access Control · 2022$6,00076votes
- #3211031Valid`use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using itCloudflare Public Bug Bounty · Cross-site Scripting · 2025 · Medium$55075votes
- #2094346ValidYet Another CASB Integration Takeover of Active IntegrationsCloudflare Public Bug Bounty · No weakness recorded · 2023–68votes
- #3423950Valid[Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuthCloudflare Public Bug Bounty · Cross-site Scripting · 2026 · High–63votes
- #3424998ValidAI Playground XSS to steal user-chat messages and access to connected MCP ServerCloudflare Public Bug Bounty · Cross-site Scripting · 2026 · Low–62votes
- #2170559ValidBypass R2 payment screenCloudflare Public Bug Bounty · Authentication · 2023$35057votes
- #3622877ValidHTTP Request Smuggling via Unsanitized Hop-by-Hop HeadersCloudflare Public Bug Bounty · Access Control · 2026 · High$1,50054votes
- #1467044ValidBlind SSRF on platform.dash.cloudflare.com Due to Sentry misconfigurationCloudflare Public Bug Bounty · Server-Side Request Forgery · 2022–54votes
- #3316910ValidSecond-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATOCloudflare Public Bug Bounty · Cross-site Scripting · 2025 · Low–50votes
- #2802817InformativeAny WARP User Can Access Organization-Specific ApplicationCloudflare Public Bug Bounty · Authentication · 2025 · None–46votes
- #1575912ValidHTTP request smuggling with Origin Rules using newlines in the host_header action parameterCloudflare Public Bug Bounty · Injection and Smuggling · 2022$3,10046votes
- #2122690ValidAccessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seatCloudflare Public Bug Bounty · Authentication · 2023–43votes
- #1618021ValidEnable 2Fa verification without verifying emailCloudflare Public Bug Bounty · Access Control · 2022–40votes
- #1570874ValidArbitrary file read from Cloudflare Pages build environmentCloudflare Public Bug Bounty · No weakness recorded · 2024–40votes
- #1543259ValidSignup with any Email and Enable 2-FA without verifying EmailCloudflare Public Bug Bounty · Authentication · 2022–40votes
- #3321406Valid[Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp AuthCloudflare Public Bug Bounty · No weakness recorded · 2026 · High–39votes
- #1391635ValidBypassing Cache Deception Armor using .avif extension fileCloudflare Public Bug Bounty · Information Disclosure · 2022–36votes
- #1664974ValidBypass two-factor authenticationCloudflare Public Bug Bounty · Authentication · 2022$25034votes
- #1525309ValidA malicious actor could rotate tokens of a victim, given that he knows the victim's token IDCloudflare Public Bug Bounty · Access Control · 2023–34votes
- #1593404ValidSign in with Apple works on existing accounts, bypasses 2FACloudflare Public Bug Bounty · Authentication · 2022$1,00032votes
- #1781096Valid💥💥Crash report -Cloudflare WARP doesn't verify text length in "Excluded Host" name input data💥💥Cloudflare Public Bug Bounty · Memory Corruption · 2023–29votes
- #1700276ValidTake over subdomains of r2.dev using R2 custom domainsCloudflare Public Bug Bounty · No weakness recorded · 2022$1,12528votes
- #1507412ValidAPI docs expose an active token for the sample domain theburritobot.comCloudflare Public Bug Bounty · Information Disclosure · 2022$50028votes
- #1615743InformativeBasic XSS [WAF Bypasses]Cloudflare Public Bug Bounty · No weakness recorded · 2023$5027votes
- #2174818InformativeYAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.comCloudflare Public Bug Bounty · Injection and Smuggling · 2023–24votes
- #1728292ValidCloudflare is not properly deleting user's accountCloudflare Public Bug Bounty · Input Validation and Logic · 2023–23votes
- #1724464Validcd=false (DNSSEC) not respected in DNS over HTTPS JSON requestsCloudflare Public Bug Bounty · Input Validation and Logic · 2022$25023votes
- #1803659ValidOrigin IP address disclosure through Pingora response headerCloudflare Public Bug Bounty · Information Disclosure · 2023–21votes
- #1633231ValidCompletely remove VPN profile from locked WARP iOS cient.Cloudflare Public Bug Bounty · Input Validation and Logic · 2022$1,00021votes
- #1605847ValidI found another way to bypass Cloudflare Warp lock!Cloudflare Public Bug Bounty · Input Validation and Logic · 2022$1,00020votes
- #1812705ValidBypassing creation of API tokens without email verificationCloudflare Public Bug Bounty · Authentication · 2023–19votes
- #1593413ValidSign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accountsCloudflare Public Bug Bounty · Authentication · 2022$25017votes
- #1825227ValidSession mismatch leading to potential account takeover (local access required)Cloudflare Public Bug Bounty · Insecure Direct Object Reference · 2023–16votes
- #1754811ValidExtraction of Pages build scripts, config values, tokens, etc. via symlinksCloudflare Public Bug Bounty · Information Disclosure · 2023$50012votes
- #1635748ValidAbility to bypass locked Cloudflare WARP on wifi networks.Cloudflare Public Bug Bounty · Input Validation and Logic · 2022$1,00012votes
- #1624911ValidMisconfigured build on websites "abuse.cloudflare.com"Cloudflare Public Bug Bounty · No weakness recorded · 2022$10012votes
- #1675730ValidPassword Policy Restriction BypassCloudflare Public Bug Bounty · Misconfiguration and Insecure Design · 2022–11votes
- #1979372ValidPrivilege escalation to root in Pages build image v2Cloudflare Public Bug Bounty · Access Control · 2023$35010votes
- #1542450ValidBypass Cloudflare WARP lock on iOS.Cloudflare Public Bug Bounty · Input Validation and Logic · 2022$50010votes
- #1636320ValidLack of Packet Sanitation in Goflow Results in Multiple DoS Attack Vectors and BugsCloudflare Public Bug Bounty · Denial of Service · 2022$5008votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.