sorona.xyz bug bounty programs
apache.org Updated
Sorona.xyz runs 19 public programs on Sorona and its own site; 19 pay cash, the most up to $1,500 (Apache Impala).
- Top reward
- $1,500
- Sorona
- Programs
- 19
- 19 pay cash
- Targets in scope
- 216
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
19 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Apache Impala
Sorona · Pays the most of the 19 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Apache Impala
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
Apache Druid
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Log4j 2
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache APISIX
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache NuttX
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Solr
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | 7 days promised | Open |
|
Apache Spark
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache HBase
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache HTTP Server
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Doris
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Superset
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Tomcat
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Hive
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Kafka
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Cassandra
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Kylin
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Traffic Server
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache Zeppelin
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
Apache
Self-hosted · Bug bounty |
– | – | – | – | Not published | None | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
- First response
- 7 days promised
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
-
- Safe harbor
- None
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
216 targets across all 19 programs, each listed once with the programs that cover it. 103 excluded.
-
Anything else shipped in the 2.x distribution, since the boundary is the release rather than a named list of modules
Products and areas
Covered by Apache Log4j 2
-
APR and APR-util, the portability libraries httpd links against and which carry their own parsing surface
Products and areas
Covered by Apache HTTP Server
-
Authentication across both services: Kerberos, LDAP, PAM and custom providers, along with impersonation and delegation-token handling
Products and areas
Covered by Apache Hive
-
Authentication and authorisation extensions, including the basic security extension, Kerberos and any escalated internal client credentials the processes use between themselves
Products and areas
Covered by Apache Druid
-
Authentication and authorisation in full: mod_session, the whole mod_auth* family and the authorisation provider chain
Products and areas
Covered by Apache HTTP Server
-
Authentication and authorisation through Shiro, covering realms, the credential store and how a role maps to note and interpreter permissions
Products and areas
Covered by Apache Zeppelin
-
Authentication and authorization plugins in full, covering the rule-based authorization plugin, JWT and Kerberos handling, and how a principal is resolved into permissions
Products and areas
Covered by Apache Solr
-
Authentication and authorization providers: PasswordAuthenticator, CassandraAuthorizer, the role hierarchy, permission grants and the resource model those grants apply to
Products and areas
Covered by Apache Cassandra
-
Authentication in every supported mode, covering Kerberos, LDAP, TLS configuration and delegation-token handling
Products and areas
Covered by Apache Impala
-
Authentication integration, covering the database, LDAP, OAuth and OIDC paths that Flask-AppBuilder exposes
Products and areas
Covered by Apache Superset
-
Authorisation and its integration with an external policy provider, including how a cached policy decision is refreshed and what happens when the cache is stale
Products and areas
Covered by Apache Impala
-
Authorisation in every mode the project ships, including SQL standard authorisation and storage-based authorisation, and the integration points where an external authorizer is consulted
Products and areas
Covered by Apache Hive
-
Backup and restore, including how remote storage credentials are handled
Products and areas
Covered by Apache Doris
-
Board support packages, peripheral drivers and the in-tree wireless stacks covering Bluetooth, Wi-Fi and modem interfaces
Products and areas
Covered by Apache NuttX
-
Bulk load of HFiles and the HFile reader itself, which parses files an operator or a job placed on the filesystem
Products and areas
Covered by Apache HBase
-
Cell-level ACLs and visibility labels, plus the VisibilityController that enforces them on a scan
Products and areas
Covered by Apache HBase
-
Config-set handling, solrconfig.xml and schema processing, and any place a configuration document reaches a class loader
Products and areas
Covered by Apache Solr
-
Configuration parsing across XML, JSON, YAML and properties formats, including the external-entity and interpolation surfaces those bring
Products and areas
Covered by Apache Log4j 2
-
Coprocessor loading, including any path by which a table attribute or an administrative operation loads code into a RegionServer JVM
Products and areas
Covered by Apache HBase
-
cqlsh and the tools the project ships, plus any sidecar or management API code in the project's repositories
Products and areas
Covered by Apache Cassandra
-
Credential and secret handling across the cluster, including delegation tokens and anything written into a configuration a worker reads
Products and areas
Covered by Apache Spark
-
Cron scheduling on notes, which runs paragraphs unattended under a stored identity
Products and areas
Covered by Apache Zeppelin
-
Database connection handling: the connection string parser, the driver-specific parameters, the credential store and the allow-lists meant to stop connection parameters becoming a file read or a code path
Products and areas
Covered by Apache Superset
-
Deep storage and the metadata store: the connection configuration, the credentials held for them and what the cluster does with data read back
Products and areas
Covered by Apache Druid
-
Delegation tokens: issuance, renewal, expiry and the HMAC that authenticates them
Products and areas
Covered by Apache Kafka
-
Every appender shipped in the main distribution, wherever a log record leaves the process for a file, socket or database
Products and areas
Covered by Apache Log4j 2
-
Every ingest path, covering streaming loads, broker loads, routine loads driven from a message queue and the file formats each of them parses
Products and areas
Covered by Apache Doris
-
Every other module shipped in the httpd tree, since the boundary the ASF draws is the tree rather than a named list of modules
Products and areas
Covered by Apache HTTP Server
-
Every process type in a cluster: broker, coordinator, overlord, historical, middle manager, indexer, peon and router, including the HTTP surface each one exposes
Products and areas
Covered by Apache Druid
-
Every shipped interpreter, including Spark, Flink, JDBC, Python, R, shell and the markdown and Angular display paths
Products and areas
Covered by Apache Zeppelin
-
Execution on the underlying engines, covering how a compiled plan reaches the cluster and what it is allowed to do there
Products and areas
Covered by Apache Hive
-
File format and serialisation handling: ORC, Parquet, Avro, text formats and every reader that opens a file the query planner pointed at
Products and areas
Covered by Apache Hive
-
Guardrails, timeouts and the limits meant to stop a single query taking down a node
Products and areas
Covered by Apache Cassandra
-
HiveServer2 in full: the Thrift and HTTP transports, session handling, the JDBC and ODBC surface and the operations a client can invoke
Products and areas
Covered by Apache Hive
-
HTTP/1.1 and HTTP/2 in full, from parsing through the request and response transformation pipeline the proxy runs over both
Products and areas
Covered by Apache Traffic Server
-
Impersonation and proxy-user handling, where the engine executes work on behalf of somebody else
Products and areas
Covered by Apache Impala
-
Import and export of dashboards, charts and datasets, where a YAML or ZIP artifact from elsewhere is deserialised into objects
Products and areas
Covered by Apache Superset
-
Ingestion end to end: task and supervisor specs, streaming ingestion from message queues, batch ingestion, and the transform and filter expressions a spec can carry
Products and areas
Covered by Apache Druid
-
Input sources and input formats, covering HTTP, object storage, HDFS and local file inputs and every file and compression format the parsers accept
Products and areas
Covered by Apache Druid
-
Inter-process communication and the coordination layer, including what a process accepts from something presenting itself as a peer
Products and areas
Covered by Apache Druid
-
Interpreter configuration and dependency loading, covering the properties an authorised user can set and the artifacts Zeppelin resolves and puts on a classpath
Products and areas
Covered by Apache Zeppelin
-
JMX, nodetool and the management operations they expose, along with the audit logging and full query logging subsystems
Products and areas
Covered by Apache Cassandra
-
JMX, the metrics surface and any endpoint that exposes cluster or client state
Products and areas
Covered by Apache Kafka
-
Kafka Connect end to end: the REST API, connector and converter configuration, plugin path loading and the worker's execution of connector code
Products and areas
Covered by Apache Kafka
-
Kafka Streams and the state stores it maintains on local disk
Products and areas
Covered by Apache Kafka
-
Kylin publishes no project-specific security policy. The declared path is the ASF-wide one, with Kylin listed in the foundation's project directory against [email protected], and no scope boundary is stated anywhere, so the whole Kylin tree is in
Products and areas
Covered by Apache Kylin
-
Log segment, index and snapshot parsing on startup and recovery
Products and areas
Covered by Apache Kafka
-
log4j-api and the Kotlin and Scala API bindings that applications actually call
Products and areas
Covered by Apache Log4j 2
-
log4j-core in full, the implementation that carries the interesting machinery
Products and areas
Covered by Apache Log4j 2
-
Lookups, plugin resolution and the pattern layout engine, the components that give attacker-controlled log data a way to reach code
Products and areas
Covered by Apache Log4j 2
-
Materialised views, and the machinery that keeps them refreshed on a schedule
Products and areas
Covered by Apache Doris
-
Materialised views, secondary indexes and the SAI index implementation
Products and areas
Covered by Apache Cassandra
-
Memory management, covering the heap allocator, the MMU and MPU configuration paths and the address environment machinery meant to separate processes
Products and areas
Covered by Apache NuttX
-
mod_proxy in full, with every backend it ships: mod_proxy_http, _ajp, _uwsgi and _fcgi, historically the richest seam in the codebase
Products and areas
Covered by Apache HTTP Server
-
Network applications shipped in the apps tree, including the web server, the FTP and Telnet daemons, DHCP and the NSH shell reachable over serial or over the network
Products and areas
Covered by Apache NuttX
-
Notebook rendering in the browser: paragraph output, the Angular display system, dynamic forms and anything that puts stored content back on a page
Products and areas
Covered by Apache Zeppelin
-
Notebook storage and the repository backends, including the local, Git, S3 and other remote storage implementations and the permissions attached to a note
Products and areas
Covered by Apache Zeppelin
-
Produce-path decompression across gzip, snappy, lz4 and zstd, and the record batch format the broker validates
Products and areas
Covered by Apache Kafka
-
PySpark in full, covering the Python worker protocol, cloudpickle payload handling, model loading in the ML library, and the installer that unpacks a downloaded distribution
Products and areas
Covered by Apache Spark
-
Query parsing across every parser Solr exposes, including function queries, the streaming expression language and the SQL interface
Products and areas
Covered by Apache Solr
-
Replication and the follower fetch protocol, including how a broker decides another broker is entitled to replicate a partition
Products and areas
Covered by Apache Kafka
-
Replication between clusters, including the WAL entries shipped and the credentials the replication peer uses
Products and areas
Covered by Apache HBase
-
Replication, backup and restore, which move index files and credentials between machines
Products and areas
Covered by Apache Solr
-
Request and response rewriting, header manipulation, and the proxy path to upstreams over HTTP, gRPC, WebSocket and raw TCP or UDP streams
Products and areas
Covered by Apache APISIX
-
Request parsing end to end, covering the request line, headers and chunked encoding, plus any framing disagreement between Tomcat and a fronting proxy such as httpd or nginx
Products and areas
Covered by Apache Tomcat
-
Route matching and upstream selection, covering the router, host and path matching, priorities, variables and the rules that decide which upstream a request reaches
Products and areas
Covered by Apache APISIX
-
Row-level security and any other tenant boundary an operator relies on to keep one team's rows away from another
Products and areas
Covered by Apache Superset
-
Scratch directory and spill-to-disk handling, and the credentials held for object storage
Products and areas
Covered by Apache Impala
-
Scripting and plugin loading, including anything that resolves a class name or a URL from configuration
Products and areas
Covered by Apache Solr
-
SECURITY.md accepts any undisclosed vulnerability in Superset privately at the project security address, and the vendor separately invites upstream reports. Neither side declares a component carve-out, so the whole application is in scope
Products and areas
Covered by Apache Superset
-
Segment handling: the segment file format, loading, downloading and the code that opens a segment the process did not create
Products and areas
Covered by Apache Druid
-
Session management in full: identifier generation, the SessionManager and every persistence backend, where deserialization gadgets surface
Products and areas
Covered by Apache Tomcat
-
Snapshot creation, export and restore, and the filesystem paths those operations construct
Products and areas
Covered by Apache HBase
-
SolrCloud and its ZooKeeper interaction: cluster state, leader election, the collections API and inter-node requests that carry a trusted identity
Products and areas
Covered by Apache Solr
-
Spark Connect end to end: the gRPC service, its protocol definitions, and everything a client sends the server or the server returns to a client
Products and areas
Covered by Apache Spark
-
Spark Core: the RPC layer, the block manager, the external shuffle service, and the driver-to-executor channel
Products and areas
Covered by Apache Spark
-
Spark SQL and Catalyst, including query parsing, generated code, user-defined function registration and data source resolution
Products and areas
Covered by Apache Spark
-
SQL Lab end to end, covering query execution, the async query worker, result caching and the controls that are supposed to keep a user inside the databases their role allows
Products and areas
Covered by Apache Superset
-
Standalone YAML configuration mode and the reload path that picks up a changed file
Products and areas
Covered by Apache APISIX
-
Streaming, repair and hinted handoff, all of which move data files and mutations between nodes
Products and areas
Covered by Apache Cassandra
-
Structured Streaming, checkpoint writing and state restore, where a job resumes from data written on a previous run
Products and areas
Covered by Apache Spark
-
The Admin API in full: its key-based authentication, the allow-list that fronts it, and every resource it can create, modify or delete on a running gateway
Products and areas
Covered by Apache APISIX
-
The admin client operations and the shipped command line tools in bin/, plus MirrorMaker 2
Products and areas
Covered by Apache Kafka
-
The Admin UI and the administrative endpoints behind it, including core creation, core reload, replication and the config-set upload path
Products and areas
Covered by Apache Solr
-
The ASF process accepts any undisclosed vulnerability in Zeppelin privately at [email protected], and the project's threat model narrows what counts as a finding rather than which components are eligible. The whole server is in scope
Products and areas
Covered by Apache Zeppelin
-
The ASF process accepts reports on any Apache project by private mail to [email protected], and APISIX publishes its own threat model naming the issue classes it treats as vulnerabilities. Read that first; nothing narrower than the APISIX tree is carved out
Products and areas
Covered by Apache APISIX
-
The ASF security process accepts any undisclosed vulnerability in an Apache project privately, and Cassandra declares no scope narrower than the code the project releases. Everything below sits inside that
Products and areas
Covered by Apache Cassandra
-
The ASF security process accepts any undisclosed vulnerability in an Apache project privately, and Kafka declares no scope narrower than the code the project releases. Everything below sits inside that
Products and areas
Covered by Apache Kafka
-
The ASF security process accepts any undisclosed vulnerability in an Apache project privately, and Spark declares nothing narrower in its SECURITY.md. Everything the Spark distribution ships sits inside that
Products and areas
Covered by Apache Spark
-
The ASF security team accepts reports on the Log4j 2 codebase through [email protected], and the project publishes its own out-of-scope list at logging.apache.org/security.html. Everything below sits inside that boundary
Products and areas
Covered by Apache Log4j 2
-
The ASF security team takes reports at [email protected] for a component shipped in the Traffic Server tree. Administrative users are treated as trusted by the project, HTTP/3 and QUIC are declared experimental and are not handled as security issues, and everything below sits inside what remains
Products and areas
Covered by Apache Traffic Server
-
The ASF security team takes reports at [email protected] for a defect in a module shipped in the httpd tree, or in APR and APR-util, on a currently supported release. That is the boundary, and everything below sits inside it
Products and areas
Covered by Apache HTTP Server
-
The authentication and authorisation layer Tomcat ships, including the realm implementations that decide who a request is
Products and areas
Covered by Apache Tomcat
-
The authentication and privilege model end to end: users, roles, catalog, database, table and column level grants, and how a grant is cached
Products and areas
Covered by Apache Doris
-
The authentication layer across SASL PLAIN, SCRAM, GSSAPI and OAUTHBEARER, mutual TLS, and the principal builder that turns a certificate or a token into a Kafka identity
Products and areas
Covered by Apache Kafka
-
The authentication plugins as a family, including jwt-auth, basic-auth, key-auth and forward-auth, and the identity each of them hands to the upstream
Products and areas
Covered by Apache APISIX
-
The authorization stack: the AccessController coprocessor and permission checks at global, namespace, table, column family and qualifier level
Products and areas
Covered by Apache HBase
-
The authorizer and ACL evaluation, covering topic, group, cluster, transactional ID and delegation token resources, prefix matching and deny precedence
Products and areas
Covered by Apache Kafka
-
The backend nodes in full: query execution, the storage layer and the RPC they accept from the frontend and from one another
Products and areas
Covered by Apache Doris
-
The bin/solr command-line tooling, including the auth setup path that writes credentials to disk
Products and areas
Covered by Apache Solr
-
The binary loader and its ELF, NXFLAT and module-loading paths, which read code an attacker may have placed on storage
Products and areas
Covered by Apache NuttX
-
The broker's handling of the wire protocol in full, every request type and every version of each, including the versions a client can negotiate down to
Products and areas
Covered by Apache Kafka
-
The build engine and the job scheduler, covering job submission, job configuration and what a job is permitted to do on the underlying cluster
Products and areas
Covered by Apache Kylin
-
The built-in data source connectors: file formats read from a path a job can influence, the JDBC source, and the cloud object-store paths
Products and areas
Covered by Apache Spark
-
The bundled Manager and Host-Manager web applications and the authentication boundary in front of them
Products and areas
Covered by Apache Tomcat
-
The bundled web interface and everything reachable from it
Products and areas
Covered by Apache Doris
-
The C library and POSIX compatibility layer, where string, printf and locale handling process data that arrived over the network
Products and areas
Covered by Apache NuttX
-
The cache in full: cache-key computation, the on-disk store, and the revalidation and eviction logic that decide what a later client is served
Products and areas
Covered by Apache Traffic Server
-
The caching layer and the metadata database, including anything that leaks one user's cached results to another
Products and areas
Covered by Apache Superset
-
The catalog service and the state store, including what each accepts from the other daemons and how metadata changes propagate
Products and areas
Covered by Apache Impala
-
The chart and dashboard layer, including saved queries, filters, the Jinja templating in datasets and any place a stored value is rendered back into a page
Products and areas
Covered by Apache Superset
-
The client-facing interfaces in full: the Thrift protocols, the HTTP transport and the JDBC and ODBC surface built on them
Products and areas
Covered by Apache Impala
-
The commit log and its replay on startup, plus snapshot and incremental backup handling
Products and areas
Covered by Apache Cassandra
-
The Control API and the status endpoints a running data plane exposes
Products and areas
Covered by Apache APISIX
-
The coordinator and executor roles of the query daemon, including query planning, code generation and execution
Products and areas
Covered by Apache Impala
-
The Coyote connectors in full: HTTP/1.1, HTTP/2 and AJP, and the protocol handlers underneath them
Products and areas
Covered by Apache Tomcat
-
The CQL parser and the native protocol between a client and a coordinator node, including every protocol version the server still accepts
Products and areas
Covered by Apache Cassandra
-
The credentials feature, which stores data source secrets on a user's behalf and injects them into interpreter sessions
Products and areas
Covered by Apache Zeppelin
-
The crypto and TLS integration paths that constrained applications rely on for confidentiality
Products and areas
Covered by Apache NuttX
-
The data import and extraction paths that pull documents from remote sources and hand them to parsers
Products and areas
Covered by Apache Solr
-
The datasource connections to Hive, JDBC sources and streaming inputs, along with the credentials configured for each
Products and areas
Covered by Apache Kylin
-
The default servlet and the whole static-resource path, including the resources and WEB-INF boundary that separates served content from application internals
Products and areas
Covered by Apache Tomcat
-
The diagnostic package and log collection endpoints, and what they include about the cluster
Products and areas
Covered by Apache Kylin
-
The etcd configuration path: how configuration reaches the data plane, how it is validated on arrival, and what a hostile or compromised configuration source can make the gateway do
Products and areas
Covered by Apache APISIX
-
The extension loading mechanism and the classpath it assembles, including how an extension's configuration is trusted
Products and areas
Covered by Apache Druid
-
The external catalog surface: the connections to Hive, Iceberg, JDBC sources and object storage, along with the credentials held for each
Products and areas
Covered by Apache Doris
-
The external plugin runner boundary, including the Java runner that carried CVE-2025-27446, and the Wasm plugin host
Products and areas
Covered by Apache APISIX
-
The filesystem layer and every filesystem driver in the tree: FAT, littlefs, SmartFS, ROMFS, the NFS client and the procfs and binfs pseudo-filesystems
Products and areas
Covered by Apache NuttX
-
The frontend nodes in full: the MySQL-compatible protocol front door, SQL parsing and planning, metadata storage and the leader election between them
Products and areas
Covered by Apache Doris
-
The full HTTP API surface: query handlers, update handlers, the schema and config APIs, and every request handler a core exposes
Products and areas
Covered by Apache Solr
-
The group coordinator and the consumer group protocol, along with the transaction coordinator and the exactly-once machinery
Products and areas
Covered by Apache Kafka
-
The HCatalog and WebHCat REST surface, and any other HTTP endpoint the distribution exposes
Products and areas
Covered by Apache Hive
-
The helium plugin framework and the visualisation packages it loads
Products and areas
Covered by Apache Zeppelin
-
The Hive Metastore Thrift API in full, including every metadata operation, the backing database access underneath it and the code that trusts a caller's identity
Products and areas
Covered by Apache Hive
-
The HTTP and REST APIs exposed on both node types, including the administrative, diagnostic and metrics routes
Products and areas
Covered by Apache Doris
-
The inter-node communication layer, and what a node accepts from something claiming to be a peer
Products and areas
Covered by Apache Doris
-
The internode gossip and messaging protocols, including internode authentication, encryption and the decision that a peer belongs in the cluster
Products and areas
Covered by Apache Cassandra
-
The interpreter framework: process launch, binding modes, the per-user and per-note isolation options and everything that decides which interpreter process a paragraph runs in
Products and areas
Covered by Apache Zeppelin
-
The kernel: scheduling, task and thread management, signals, message queues, and the system call boundary between user and kernel mode in protected and kernel builds
Products and areas
Covered by Apache NuttX
-
The KRaft controller quorum, the metadata log and the records that flow through it, plus the ZooKeeper-mode metadata paths the project still ships
Products and areas
Covered by Apache Kafka
-
The Lua and OpenResty layer the gateway is written in, including any path that reaches the nginx Lua API with attacker-controlled data
Products and areas
Covered by Apache APISIX
-
The Master and RegionServer web UIs and everything they disclose about tables, regions, configuration and running operations
Products and areas
Covered by Apache HBase
-
The metadata path through the Hive Metastore, including everything Impala trusts from metadata it did not create
Products and areas
Covered by Apache Impala
-
The metadata store and every operation that reads or writes it, including how metadata written by one project is isolated from another
Products and areas
Covered by Apache Kylin
-
The Metastore schema tools, the beeline client and the JDBC driver the project ships
Products and areas
Covered by Apache Hive
-
The model and cube definition path, where a definition submitted over the API becomes a build job on the cluster
Products and areas
Covered by Apache Kylin
-
The notebook REST API and the WebSocket API in full, including origin validation, session handling and the authorisation checks on each message type
Products and areas
Covered by Apache Zeppelin
-
The NuttX network stack end to end: IPv4 and IPv6, TCP, UDP, ICMP, the socket layer, and the 6LoWPAN and IEEE 802.15.4 paths used on low-power radios
Products and areas
Covered by Apache NuttX
-
The per-daemon debug web interfaces and everything reachable from them, including the query profiles and logs they expose
Products and areas
Covered by Apache Impala
-
The policy asks for a private email to [email protected] with the HBase PMC looped in, and it links a published threat model that defines the trust boundaries and what constitutes a valid report. Read that model first. It is the declared scope, and it names no exclusion narrower than the assumptions it lists
Products and areas
Covered by Apache HBase
-
The project declares its threat-model.md the canonical source for scope and for triage classification, and its SECURITY.md asks for any Doris security finding at [email protected]. Read the threat model before you start, and treat everything below as sitting inside it
Products and areas
Covered by Apache Doris
-
The project publishes a threat model naming its trust boundaries, and a SECURITY.md that routes reports through the ASF process to the project security list while ruling out public issues and pull requests. Those two documents define what the maintainers accept, and everything below sits inside them
Products and areas
Covered by Apache Hive
-
The proxy's two legs and the framing agreement between them, where the client-facing side and the origin-facing side can disagree about where one message ends
Products and areas
Covered by Apache Traffic Server
-
The published policy asks for security issues by private mail to the project security list and rules out GitHub issues and the public dev list. It draws no boundary narrower than the NuttX tree itself, and the ASF vulnerability handling policy governs from there
Products and areas
Covered by Apache NuttX
-
The published reporting process accepts any undisclosed security issue in Solr privately, with the PMC triaging it and the ASF process carrying it to a CVE. THREAT_MODEL.md narrows what counts as a finding rather than which components are in scope, so the whole server is fair ground
Products and areas
Covered by Apache Solr
-
The query and UDF execution layer, including user-defined functions, custom serialisation handlers and the mechanism that loads a JAR named by a session
Products and areas
Covered by Apache Hive
-
The query compiler and optimizer, covering parsing, view expansion and how privileges are resolved against the objects a query touches
Products and areas
Covered by Apache Hive
-
The query layer in full, covering native JSON queries, Druid SQL, the parsing and planning of both, and every function they can reach
Products and areas
Covered by Apache Druid
-
The query pushdown path, where a query Kylin cannot answer from a cube is forwarded to an underlying engine
Products and areas
Covered by Apache Kylin
-
The query server and its entire REST API, including the administrative, system and diagnostic routes as well as the query endpoints
Products and areas
Covered by Apache Kylin
-
The remap rule engine and regex remap, which decide which origin a request is sent to
Products and areas
Covered by Apache Traffic Server
-
The repository's security policy asks that new vulnerabilities be reported through the ASF process to [email protected] and draws no boundary narrower than Druid itself
Products and areas
Covered by Apache Druid
-
The repository's SECURITY.md is a security threat model rather than an intake policy, so the declared scope is the trust boundaries it sets out, and reports go to the ASF-wide security address. Read that document first and treat everything below as sitting inside it
Products and areas
Covered by Apache Impala
-
The REST API in full, including the security, chart, dashboard, dataset and database endpoints, plus the CSRF and session handling in front of them
Products and areas
Covered by Apache Superset
-
The role and permission model in full: Gamma, Alpha, Admin, custom roles and every permission check that decides whether a user reaches a dashboard, chart, dataset or database
Products and areas
Covered by Apache Superset
-
The RPC layer between clients and the Master or a RegionServer, covering authentication, the SASL and Kerberos handshake and delegation token handling
Products and areas
Covered by Apache HBase
-
The scan layer and every file format reader: Parquet, ORC, Avro, text and the compression codecs behind them, all running as native code over files a user can place in a table location
Products and areas
Covered by Apache Impala
-
The shell and the administrative operations it drives, where they change server-side state
Products and areas
Covered by Apache HBase
-
The Spark UI, the History Server and the standalone master and worker, covering authentication, the ACL filters including the built-in JWSFilter, and the reverse-proxy paths
Products and areas
Covered by Apache Spark
-
The storage engine, the SSTable format and the compaction path that rewrites it
Products and areas
Covered by Apache Cassandra
-
The submission surface on YARN and Kubernetes, including how an application's configuration, jars and Python dependencies are fetched and staged
Products and areas
Covered by Apache Spark
-
The Thrift and REST gateways in full, including their own authentication and the impersonation they perform on behalf of end users
Products and areas
Covered by Apache HBase
-
The Thrift JDBC and ODBC server, which accepts queries from remote clients
Products and areas
Covered by Apache Spark
-
The Tomcat security team takes reports at [email protected] for a defect in Tomcat itself on a supported branch. Application code deployed into the container is the application's problem, the 7.x and 8.5.x lines are end of life, and everything below sits inside what remains
Products and areas
Covered by Apache Tomcat
-
The TSAPI plugin interface and every plugin shipped in the tree, including cachekey
Products and areas
Covered by Apache Traffic Server
-
The web console and everything reachable from it, including its authentication and session handling
Products and areas
Covered by Apache Kylin
-
The web console and everything reachable from it, including the routes it calls on the user's behalf
Products and areas
Covered by Apache Druid
-
The web interfaces exposed by the services and everything reachable from them
Products and areas
Covered by Apache Hive
-
The whole plugin set, where the gateway's logic actually lives: authentication, authorisation, traffic control, request and response transformation, observability and serverless plugins alike
Products and areas
Covered by Apache APISIX
-
The whole request pipeline, from connection handling through mod_http parsing to the response: the request line, headers, chunked and Transfer-Encoding handling, and any framing disagreement between the core and a module that reframes a request
Products and areas
Covered by Apache HTTP Server
-
The ZooKeeper interaction, the znodes HBase relies on and the ACLs protecting them
Products and areas
Covered by Apache HBase
-
Thumbnails, alerts and reports, which render pages server-side and make outbound requests on a schedule
Products and areas
Covered by Apache Superset
-
TLS handling in full, including SNI routing, certificate selection and the sni.yaml policy layer
Products and areas
Covered by Apache Traffic Server
-
Transparent encryption of HFiles and WALs, along with the key provider and key handling behind it
Products and areas
Covered by Apache HBase
-
URL and path handling end to end, covering mod_rewrite, mod_alias and the core's own mapping of a request onto a file
Products and areas
Covered by Apache HTTP Server
-
USB device and host stacks, including the CDC, MSC and composite classes that parse descriptors from the other end of the cable
Products and areas
Covered by Apache NuttX
-
User-defined functions and aggregates, the languages they may be written in, and the sandboxing and resource limits around their execution
Products and areas
Covered by Apache Cassandra
-
User-defined functions, covering both the native and the JVM paths and the loading of a binary named by a session
Products and areas
Covered by Apache Impala
-
User-defined functions, including the Java UDF path and anything else that loads code into an executing node
Products and areas
Covered by Apache Doris
-
Users, roles and project-level access control, including how a permission decision is made and cached
Products and areas
Covered by Apache Kylin
-
Virtual tables, the system keyspaces and what a low-privileged role can read from them
Products and areas
Covered by Apache Cassandra
No target matches. Try part of a host name, such as the company name.
Out of scope 103
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
A broker deliberately configured with a PLAINTEXT listener and no authorizer, which is a deployment decision
Apache Kafka
-
A cluster deliberately deployed with authentication and authorisation disabled on an untrusted network, which the project treats as a deployment decision
Apache Druid
-
A cluster deliberately exposed to an untrusted network with default credentials, which is a deployment decision
Apache Doris
-
A cluster deliberately run with AllowAllAuthenticator or AllowAllAuthorizer, which is a configuration decision
Apache Cassandra
-
A cluster deliberately run without authentication or with impersonation disabled, which the threat model treats as a deployment decision
Apache Hive
-
A cluster deliberately run without authentication or with the debug web interfaces published to an untrusted network, which is a deployment decision
Apache Impala
-
A deployment deliberately published to an untrusted network with default credentials in place, which is a deployment decision
Apache Kylin
-
A deployment left with authentication disabled, which is a configuration decision rather than a Zeppelin defect
Apache Zeppelin
-
A vulnerability report on its own where the patch money is concerned: that rail pays for a merged fix rather than for the finding
Apache HTTP Server
-
Adversaries and scenarios the project's own threat model places outside its trust boundaries
Apache Impala
-
Amazon EMR, Google Dataproc, Azure Synapse and Fabric, Databricks and Cloudera: those are vendor products built on Spark, and their own code and configuration belong to the vendor
Apache Spark
-
An operator granting a role access to a database deliberately. A permission an administrator configured is a configuration decision
Apache Superset
-
An unsecured cluster, with Kerberos and authorization switched off. The threat model treats a secure configuration as the premise, so this is a deployment decision
Apache HBase
-
Anything already covered by one of the six CVEs published in the past year
Apache Kylin
-
Anything presupposing a trusted administrative user, or control over ATS binaries, scripts or configuration files
Apache Traffic Server
-
Anything the project already lists as out of scope at logging.apache.org/security.html
Apache Log4j 2
-
Anything the published threat model already records as an accepted assumption or an out-of-scope condition
Apache HBase
-
Apache Lucene itself, which has its own report path even though Solr is built on it
Apache Solr
-
Apache Software Foundation infrastructure and mailing lists rather than the library
Apache Log4j 2
-
apache.org websites
Self-hosted
-
Application code deployed into Tomcat rather than a defect in Tomcat itself
Apache Tomcat
-
Board configurations an integrator wrote that deliberately enable a debug shell or an unauthenticated network service
Apache NuttX
-
Client drivers maintained outside the project's repositories
Apache Cassandra
-
Cloudera's distribution and its platform-specific patches, where the finding cannot be reproduced against the Apache release
Apache Impala
-
Clusters an operator deliberately ran without authentication or with ACLs disabled
Apache Spark
-
Code execution by a user the operator authorised to use an interpreter. Running user code is the entire purpose of the product
Apache Zeppelin
-
Commercial distributions and managed services built on Doris rather than the Apache release
Apache Doris
-
Configuration errors such as exposing the Manager application to the internet
Apache Tomcat
-
Configuration-only issues where the administrator has explicitly enabled an unsafe directive
Apache HTTP Server
-
Confluent Platform, Amazon MSK, Aiven and other managed or repackaged distributions, all of which run their own programmes over their own infrastructure
Apache Kafka
-
Connectors, converters and client libraries maintained outside the apache/kafka repository
Apache Kafka
-
Custom or third-party plugins an operator wrote and loaded, as distinct from plugins shipped in the APISIX tree
Apache APISIX
-
Database engines and their drivers, unless Superset's own use of the driver is what makes the defect reachable
Apache Superset
-
Databricks' HackerOne scope covers five SaaS assets and no source code at all, so a bug in the Spark tree has no home there
Apache Spark
-
DataStax Enterprise, Instaclustr and other commercial distributions, which have their own vendors and their own reporting paths
Apache Cassandra
-
Defects in Hadoop, HDFS or ZooKeeper themselves, unless HBase's own use of them is what makes the issue reachable
Apache HBase
-
Defects in the message queues, object stores or metadata databases Druid connects to, where Druid is only the client
Apache Druid
-
Defects that exist only in an out-of-tree driver or board port
Apache NuttX
-
Denial of service proportional to request volume
Apache Traffic Server
-
Denial of service that reduces to resource exhaustion proportional to request volume
Apache HTTP Server
-
Deployment choices an operator made, such as running Solr on an open port with no authentication plugin configured
Apache Solr
-
Deployments that publish the Admin API to the internet on the default key, an operator decision rather than a gateway defect
Apache APISIX
-
Deserialization gadgets that require an unsafe application classpath the reporter supplied
Apache Tomcat
-
Downstream forks and vendor distributions built on NuttX. Xiaomi Vela, Sony's Spresense SDK and PX4 carry their own trees and their own processes
Apache NuttX
-
End-of-life branches, specifically 7.x and 8.5.x
Apache Tomcat
-
etcd itself as a product, as distinct from how APISIX talks to it and what it trusts from it
Apache APISIX
-
Findings against releases the project no longer ships
Apache Kylin
-
Findings in the abandoned 2.2 branch
Apache HTTP Server
-
Findings that require an existing cluster administrator, who can already submit tasks that run code
Apache Druid
-
Findings the project's own threat model classifies as a non-finding or places outside its trust boundaries
Apache Doris
-
Findings the threat model already answers: unauthenticated exposure of an instance an operator put on a public network, SSRF the operator's network controls are expected to bound, and features that ship disabled
Apache Solr
-
Hadoop, Hive, Spark, HBase and the other cluster components Kylin runs on, where Kylin is only the client
Apache Kylin
-
Hadoop, Ranger, the Hive Metastore and the object stores Impala reads, where Impala is only the client
Apache Impala
-
Hadoop, Ranger, the underlying object stores and the relational database behind the Metastore, where Hive is only the client
Apache Hive
-
HTTP/3 and QUIC, which the project declares experimental and explicitly does not treat as security issues
Apache Traffic Server
-
Imply's commercial distribution and hosted service, where the finding cannot be reproduced against the Apache release
Apache Druid
-
Issue classes the project's published threat model places out of scope; it exists to be read before triage
Apache APISIX
-
JMX deliberately bound to a public interface without authentication, likewise a deployment decision the documentation warns against
Apache Cassandra
-
Log4j 1.x, which is end of life and receives no fixes
Apache Log4j 2
-
Missing hardening on a deployment left with the default configuration and no authentication in front of it
Apache Superset
-
One-liner fixes for non-exploitable crashes, excluded by name in the Patch Rewards rules
Apache Tomcat Apache HTTP Server Apache Traffic Server
-
OpenResty, LuaJIT and nginx defects, which belong upstream unless APISIX's own use of them is what makes the issue reachable
Apache APISIX
-
Optional third-party appenders such as Cassandra, CouchDB and Kafka, which the project has historically excluded
Apache Log4j 2
-
Out-of-tree plugins built against TSAPI
Apache Traffic Server
-
Patches outside the one-to-twelve-month age window the program requires
Apache Log4j 2
-
Physical attacks on a device an attacker already holds, including reading flash over a debug port
Apache NuttX
-
Preset's hosted platform and its own infrastructure, which is a commercial service rather than the upstream project. The vendor address takes upstream Superset findings
Apache Superset
-
Recurring non-findings the project's threat model already records, and adversaries it places outside its trust boundaries
Apache Hive
-
Reports filed as GitHub issues or on the public dev list, which the policy rules out by name for security issues
Apache NuttX
-
Reports filed as public GitHub issues, since the ASF process requires the private list
Apache APISIX
-
Reports filed publicly on GitHub, which puts the issue outside both coordinated processes
Apache Superset
-
Reports filed publicly on JIRA or GitHub rather than through the ASF security list
Apache Cassandra Apache Kafka
-
Reports filed publicly on Jira or GitHub, which put the issue outside the coordinated process
Apache Zeppelin Apache Solr
-
Resource exhaustion from a cube build the operator sized the cluster for
Apache Kylin
-
Resource exhaustion from a query or ingestion volume the cluster was sized for
Apache Druid
-
Resource exhaustion from a query the cluster was sized for
Apache Impala Apache Doris
-
Resource exhaustion from expensive scans or compactions, which is a capacity question
Apache HBase
-
Scanner and fuzzer output with no demonstrated crossing of a trust boundary
Apache Hive
-
Scope claims made by files inside the repository rather than by the ASF policy and the published threat model
Apache HBase
-
Spark, Flink and the other engines Zeppelin drives, each of which has its own security process
Apache Zeppelin
-
The JVM and the operating system underneath the node
Apache Cassandra
-
The JVM, the operating system and the filesystem underneath the broker
Apache Kafka
-
The Tier 1 ceiling, which Tomcat cannot reach: it qualifies at Tier 2 through OSS-Fuzz, not as a named Tier 1 project
Apache Tomcat
-
The Tier 1 ceiling, which Traffic Server cannot reach: it qualifies at Tier 2 through OSS-Fuzz, not as a named Tier 1 project
Apache Traffic Server
-
Third-party connectors, packages and runtime images outside the apache/spark tree
Apache Spark
-
Third-party interpreters and helium packages that are not part of the Zeppelin distribution
Apache Zeppelin
-
Third-party libraries pulled in by an application, unless NuttX's own use of them is what makes the defect reachable
Apache NuttX
-
Third-party modules not shipped in the httpd tree, which belong with whoever wrote them
Apache HTTP Server
-
Third-party Solr plugins and connectors that are not part of the Solr distribution
Apache Solr
-
Upstream dependencies including Flask-AppBuilder, unless the defect lives in how Superset calls them
Apache Superset
-
Upstream dependencies, unless Zeppelin's own use of them is what makes the defect reachable
Apache Zeppelin
-
Upstream dependency vulnerabilities, unless Doris's own use of the dependency makes them reachable
Apache Doris
-
Upstream dependency vulnerabilities, unless Druid's own use of the dependency makes them reachable
Apache Druid
-
Upstream dependency vulnerabilities, unless Hive's own use of the dependency makes them reachable
Apache Hive
-
Upstream dependency vulnerabilities, unless Impala's own use of the dependency makes them reachable
Apache Impala
-
Upstream dependency vulnerabilities, unless Kylin's own use of the dependency makes them reachable
Apache Kylin
-
Upstream JVM, Scala or Python dependency bugs, unless Spark's own use of the dependency is what makes them reachable
Apache Spark
-
Upstream libraries Solr embeds, including Apache Tika. CVE-2025-66516 shows the pattern, a Tika XXE reached through the extraction module and attributed upstream
Apache Solr
-
Vendor distributions such as Cloudera CDP or a cloud provider's managed Hive, where the finding cannot be reproduced against the Apache release
Apache Hive
-
Vendor distributions such as EMR, CDP, Dataproc and HDInsight, where the defect lives in that vendor's packaging or management layer
Apache HBase
-
Vulnerabilities in the external systems Doris federates over, such as a Hive Metastore or a JDBC source, where Doris is only the client
Apache Doris
-
Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail
Apache Log4j 2
-
ZooKeeper itself, a separate Apache project with its own process
Apache Kafka
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in sorona.xyz products, from the NVD.
-
CVE-2026-97356 Medium
External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter o
-
CVE-2026-97355 Medium
Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this
-
CVE-2026-97356 Medium
External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter o
-
CVE-2026-97355 Medium
Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this
-
CVE-2026-97355 Medium
Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this
-
CVE-2026-97356 Medium
External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter o
-
CVE-2026-97355 Medium
Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this
-
CVE-2026-97356 Medium
External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter o
About this page
This page gathers every public program listed under apache.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.