Aiven bug bounty programs
aiven.io Updated
Aiven runs three public programs: a Bugcrowd bug bounty paying up to $25,000, a Sorona bug bounty paying up to $1,500 and a HackerOne bug bounty paying up to $10,000 (paused).
- Top reward
- $25,000
- Bugcrowd
- Programs
- 3
- 3 pay cash
- Targets in scope
- 40
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Aiven Managed Bug Bounty
Bugcrowd · Pays the most of the 3 programs: up to $25,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Aiven Managed Bug Bounty
Bugcrowd · Bug bounty |
$25k (highest) | $13.2k (highest) | $4,620 (highest) | $990 (highest) | $25,000 | Full | – | – | Open |
|
Aiven open-source repositories
Sorona · Bug bounty |
$1,500 | $1,000 | $500 | $250 | $1,500 | Partial | – | 4 days promised | Open |
|
Aiven Ltd
HackerOne · Bug bounty |
$10k | $3,000 | $1,000 | $150 | $10,000 | – | – | – | Paused |
-
- Critical
- $25k (highest)
- High
- $13.2k (highest)
- Medium
- $4,620 (highest)
- Low
- $990 (highest)
- Safe harbor
- Full
-
- Critical
- $1,500
- High
- $1,000
- Medium
- $500
- Low
- $250
- Safe harbor
- Partial
- First response
- 4 days promised
-
- Critical
- $10k
- High
- $3,000
- Medium
- $1,000
- Low
- $150
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
40 targets across all 3 programs, each listed once with the programs that cover it. 22 excluded.
-
Aiven for Apache Cassandra managed and hosted service
Products and areas No bounty
Covered by HackerOne
-
Aiven for Apache Flink (beta) managed and hosted service
Products and areas Critical
Covered by HackerOne
-
Aiven for Clickhouse (beta) managed and hosted service
Products and areas No bounty
Covered by HackerOne
-
aiven-db-migrate, aiven-extras, journalpump and the Aiven Kubernetes Operator, which run with elevated rights against live database clusters
Products and areas
Covered by Sorona
-
All of github.com/Aiven-Open. The target is the organisation, so every open-source repository it holds is covered rather than a shortlist of the well-known ones
Products and areas
Covered by Sorona
-
CTF challenge: ed25519 SSH host key of falcon-bug-bounty-flag-pgsql-dev-sandbox.aivencloud.com
Products and areas No bounty
Covered by HackerOne
-
github.com/Aiven, the legacy organisation, listed as the second target
Products and areas
Covered by Sorona
-
http://falcon-bug-bounty-flag-pgsql-dev-sandbox.e.aivencloud.com/
Products and areas
Covered by Bugcrowd
-
https://aiven.io/docs/products/metrics/concepts/metrics-overview
Products and areas
Covered by Bugcrowd
-
Karapace, the Kafka schema registry and REST proxy, Klaw, the Kafka governance portal, and the KIP-405 tiered-storage plugin, each of which sits inside the in-scope organisation and has its own page here
Products and areas
Covered by Sorona
-
MyHoard for MySQL backup, Astacus for cluster-wide backup, and rohmu, the object-storage abstraction all of them write through
Products and areas
Covered by Sorona
-
PGHoard and pglookout, the PostgreSQL backup and failover daemons, including the archive and restore paths and the failover logic that decides which node becomes primary
Products and areas
Covered by Sorona
-
What the program declares: vulnerabilities in Aiven open source code, with two targets listed, github.com/Aiven-Open and github.com/Aiven, priced under the Aiven Open Source Repositories target group at P1 $1,000 to $1,500
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 22
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.aiven.fi
Bugcrowd
-
*.avns.net
Bugcrowd
-
aiven.io/community
Bugcrowd
-
aiven.io/contact
Bugcrowd HackerOne
-
aivenhelp.zendesk.com
Bugcrowd
-
aquarium.aiven.io
Bugcrowd HackerOne
-
Creation of support tickets
Bugcrowd
-
events.aiven.io
Bugcrowd
-
https://aiven.io/runtime
Bugcrowd
-
https://www.aiven.io/contact
HackerOne
-
support.aiven.io
Bugcrowd
-
uptime.aiven.io
Bugcrowd HackerOne
-
video.aiven.io
Bugcrowd HackerOne
-
Application-level denial of service and physical security, excluded by the program's VRT baseline for every target
Sorona
-
Customer services you did not create
Bugcrowd
-
Customer-created services inside aivencloud.com that the researcher did not create themselves
Sorona
-
github.com/Aiven-Labs
Bugcrowd
-
github.com/Aiven-Labs, which the program lists explicitly as out of scope even though it is an Aiven organisation
Sorona
-
ideas.aiven.io
Bugcrowd
-
Rate-limiting findings, raw scanner output, and third-party software issues whose patch has been available for less than 30 days
Sorona
-
Third-party-hosted Aiven properties such as Calendly, Qualified, Salesforce, Zendesk and the contact form
Sorona
-
Vulnerabilities inherited from an upstream project that Aiven forked, which the program directs upstream rather than paying for
Sorona
Recent changes
Reward and scope changes across every Aiven program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Aiven products, from the NVD.
-
CVE-2026-39961 Medium
Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys, service tokens — with a single kubectl apply. The operator reads the victim's secret using its Cluste
-
CVE-2026-39961 Medium
Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys, service tokens — with a single kubectl apply. The operator reads the victim's secret using its Cluste
-
CVE-2026-29190 Medium
Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup reader (backup/backends/v3/backend.py). If a malicious backup file is provided to Karapace, an attacker may exploit insufficient path validation to perform arbitrary file read on the system where Karapace is running. The issue affects deployment
-
CVE-2026-29190 Medium
Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup reader (backup/backends/v3/backend.py). If a malicious backup file is provided to Karapace, an attacker may exploit insufficient path validation to perform arbitrary file read on the system where Karapace is running. The issue affects deployment
-
CVE-2026-25999 High
Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fix
-
CVE-2026-25999 High
Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fix
-
CVE-2025-67745 High
MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null.
-
CVE-2025-67745 High
MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null.
About this page
This page gathers every public program listed under aiven.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.