Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Cilium bug bounty programs

cilium.io Updated

Cilium runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
16
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Cilium runs.

  • Cilium

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

16 targets. 6 excluded.

  • https://cilium.io

    Web

  • CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy evaluation in full, along with Kubernetes NetworkPolicy as Cilium implements it

    Products and areas

  • Cluster Mesh, the cross-cluster identity and service model, and the trust between clusters it establishes

    Products and areas

  • DNS-based and FQDN policy: the DNS proxy, the responses it observes and the IP set a name resolves into

    Products and areas

  • Hubble, the relay, the UI and the flow data each exposes

    Products and areas

  • kube-proxy replacement, service load balancing, the egress gateway, the bandwidth manager and the NAT and masquerading paths

    Products and areas

  • Layer 7 policy enforcement, including HTTP, gRPC, Kafka and DNS rules and the proxy that applies them

    Products and areas

  • Security identity allocation, the mapping from pod labels to numeric identities, and identity garbage collection and reuse

    Products and areas

  • The BGP control plane and any route Cilium advertises or accepts

    Products and areas

  • The cilium CLI and the debug endpoints the agent exposes

    Products and areas

  • The Cilium operator and every CRD it reconciles, including the identity and endpoint resources

    Products and areas

  • The cilium-agent, its API socket, and the privileged operations a caller on that socket can request on the node

    Products and areas

  • The eBPF datapath programs and the loader that compiles and installs them, plus the maps they share with userspace

    Products and areas

  • The Envoy integration Cilium configures for layer 7 policy, Ingress and Gateway API

    Products and areas

  • The policy asks for private reports at [email protected] with GitHub Security Advisories used for publication, and declares no boundary narrower than the Cilium project's own code

    Products and areas

  • Transparent encryption with IPsec and WireGuard, key generation, key rotation and what happens to traffic during a rotation

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A network policy an operator wrote that is simply more permissive than intended

  • Envoy upstream, unless Cilium's configuration or integration of it is what makes the defect reachable

  • Managed Kubernetes providers' own forks and distribution-specific patches

  • Reports filed as public GitHub issues rather than through the security list

  • Tetragon and other sibling projects in their own repositories

  • The Linux kernel and its eBPF verifier, which is upstream and has its own process

Recent changes

Reward and scope changes across every Cilium program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Cilium products, from the NVD.

Search NVD
  • CVE-2026-56742 Medium

    Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.

  • CVE-2026-56743 Medium

    Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on select

  • CVE-2026-49445 Critical

    Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.

  • CVE-2026-10722 Low

    A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is

  • CVE-2026-41520 High

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. This issue has been patched in versions 1.17.15, 1.18.9, and 1.19.3.

  • CVE-2026-33726 Medium

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services (Envoy, GAMMA) with a local backend on the same node, when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. Per-Endpoint Routing is disabled by default, but is automa

  • CVE-2026-26963 Medium

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.

  • CVE-2025-64715 Medium

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In suc

About this page

This page gathers every public program listed under cilium.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.