Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
- Any class
- Cross-site Scripting1
- Cross-Site Request Forgery1
- Server-Side Request Forgery4
- Command and Code Injection8
- Injection and Smuggling2
- Deserialization and Object Injection1
- File and Path Handling2
- Memory Corruption3
- Race Conditions1
- Denial of Service6
- Misconfiguration and Insecure Design3
- Cryptography10
- Information Disclosure5
- Authentication12
- Access Control14
- No weakness recorded4
Access (title)Any
77 of 15,219 reports · $32,650 in bounties · 227 analysed so far
- #867699ValidNode disk DOS by writing to container /etc/hostsKubernetes · Denial of Service · 2020$1,000161votes
- #2701701ValidInjection in path parameter of Ingress-nginxKubernetes · Command and Code Injection · 2026 · High–91votes
- #1387366Validelections.k8s.io uses weak session secret key, may place elections at riskKubernetes · Cryptography · 2025 · High$25086votes
- #1580493ValidBypass validation parts in AWS IAM Authenticator for KubernetesKubernetes · Authentication · 2023$2,50068votes
- #2231019ValidCVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodesKubernetes · Command and Code Injection · 2023$5,00067votes
- #746000ValidSubdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioKubernetes · Authentication · 2020$25062votes
- #1728174ValidIngress nginx annotation injection causes arbitrary command executionKubernetes · Command and Code Injection · 2023$2,50057votes
- #1249583ValidAuthenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespacesKubernetes · Access Control · 2021–55votes
- #1842829ValidPrivilege Escalation in kOps using GCE/GCP ProviderKubernetes · Access Control · 2023$2,50052votes
- #1544133ValidSSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30XKubernetes · Server-Side Request Forgery · 2022$1,00051votes
- #1620702ValidRCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path fieldKubernetes · Command and Code Injection · 2023$2,50047votes
- #1167773ValidLoading YAML in Java client can lead to command executionKubernetes · Deserialization and Object Injection · 2021$1,00045votes
- #2039464ValidCode inject via nginx.ingress.kubernetes.io/permanent-redirect annotationKubernetes · Command and Code Injection · 2023$2,50040votes
- #1466765Validmonitoring.prow-canary.k8s.io is vulnerable to CVE-2022-21703 (Grafana 0-day)Kubernetes · Cross-Site Request Forgery · 2024 · Low$10036votes
- #1378175ValidIngress-nginx annotation injection allows retrieval of ingress-nginx serviceaccount token and secrets across all namespacesKubernetes · Command and Code Injection · 2022–34votes
- #1018413DuplicateDevelopment Application Credentials + Information ExposedKubernetes · Cryptography · 2020–31votes
- #1485500ValidFile Read Vulnerability allows Attackers to Compromise S3 buckets using ProwKubernetes · Access Control · 2023$25026votes
- #941178ValidSSRF for kube-apiserver cloudprovider sceneKubernetes · Server-Side Request Forgery · 2021–24votes
- #776017ValidHalf-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service.Kubernetes · Server-Side Request Forgery · 2020$5,00021votes
- #1466889ValidBroken link hijacking in https://kubernetes-csi.github.io/docs/drivers.html?highlight=chubaofs#production-driversKubernetes · File and Path Handling · 2022$10018votes
- #1434179ValidBroken Domain Link Takeover from kubernetes.io docsKubernetes · File and Path Handling · 2022$10017votes
- #1382919ValidIngress-nginx path allows retrieval of ingress-nginx serviceaccount tokenKubernetes · Access Control · 2022$2,50017votes
- #1051192ValidCode Injection via Insecure Yaml.loadKubernetes · Command and Code Injection · 2021$25017votes
- #1434967ValidGithub Account Takeover from Docs page of `kubernetes-csi.github.io`Kubernetes · Access Control · 2022–16votes
- #1357948InformativeAttacker can bypass authentication build on ingress external auth (`nginx.ingress.kubernetes.io/auth-url`)Kubernetes · Authentication · 2022–16votes
- #808169ValidBlind SSRF on velodrome.canary.k8s.ioKubernetes · Server-Side Request Forgery · 2021–16votes
- #1032086Validcsi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVCKubernetes · Memory Corruption · 2020$50015votes
- #1763704ValidGit Arg Injection in kubernetes-sigs/release-sdkKubernetes · No weakness recorded · 2023$10014votes
- #1398706ValidGoogle storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSSKubernetes · Access Control · 2021–14votes
- #1095612ValidNode Validation Admission does not observe all oldObject fieldsKubernetes · Access Control · 2021–14votes
- #1073363ValidIndex Out Of Bounds in protobuf unmarshallingKubernetes · Memory Corruption · 2021$25013votes
- #794382DuplicateRoute53 Subdomain Takeover on test-cncf-aws.canary.k8s.ioKubernetes · Misconfiguration and Insecure Design · 2021–13votes
- #1331361ValidBroken Link Hijacking on kubernetes.io DocumentationKubernetes · Access Control · 2021–12votes
- #776461InformativeUsername enumeration via Openssh 7.6Kubernetes · No weakness recorded · 2020–12votes
- #1130416ValidSHA512 incorrect on most/many releasesKubernetes · Cryptography · 2021–11votes
- #1807214ValidThe `io.kubernetes.client.util.generic.dynamic.Dynamics` contains a code execution vulnerability due to SnakeYAMLKubernetes · Command and Code Injection · 2023$1,00010votes
- #863979ValidCompromise of node can lead to compromise of pods on other nodesKubernetes · No weakness recorded · 2020–10votes
- #819717ValidIPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisementsKubernetes · Cryptography · 2021–10votes
- #1073514InformativeXSS on kubernetes-csi.github.io (mdBook)Kubernetes · Cross-site Scripting · 2021–9votes
- #774896ValidKubelet resource exhaustion attack via metric label cardinality explosion from unauthenticated requestsKubernetes · Denial of Service · 2020 · no account (title)–9votes
- #778803ValidCompromise of auth via subset/superset namespace names.Kubernetes · Authentication · 2020–8votes
- #1350755ValidTokenless GUI AuthenticationKubernetes · Authentication · 2021–7votes
- #972561Validkubeadm logs tokens before deleting themKubernetes · Authentication · 2020–7votes
- #859962ValidBypass apiserver proxy filterKubernetes · Race Conditions · 2021–7votes
- #1398572ValidBroken Link Takeover from kubernetes.io docsKubernetes · Access Control · 2021–6votes
- #882923ValidDoS for client-go jsonpath funcKubernetes · Denial of Service · 2020–6votes
- #802011ValidGrafana Improper authorizationKubernetes · Access Control · 2020–6votes
- #1238017N/AAWS Load Balancer Controller Managed Security Groups can be replaced by an unprivileged attackerKubernetes · Injection and Smuggling · 2022 · a user account (title)$5005votes
- #1145044ValidHoles in EndpointSlice Validation Enable Host Network HijackKubernetes · Access Control · 2021–5votes
- #1092859ValidKOPS documentation references domains which were not registeredKubernetes · Access Control · 2021–5votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.