Cloudflare bug bounty programs
cloudflare.com Updated
Cloudflare runs 6 public programs on Sorona, HackerOne and its own site; 5 pay cash, the most up to $10,000 (Cloudflare Public Bug Bounty). It also owns cfssl.org, which runs one more program.
- Top reward
- $10,000
- HackerOne
- Programs
- 7
- 6 pay cash
- Targets in scope
- 104
- 4 types, deduplicated
- Last change
- 12 Nov 2026
- 13 hours ago
Where to report
6 programs Cloudflare runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
CloudFlare
Self-hosted · The company-wide program. Use it when no owned company's program fits.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Cloudflare Public Bug Bounty
HackerOne · Bug bounty |
$10k (highest) | $3,000 | $750 | $500 | $10,000 | Partial | – | 9 hours average | Open |
|
workerd
Sorona · Bug bounty |
– | $3,750 (highest) | $938 (highest) | $625 (highest) | $3,750 | Partial | – | 10 days promised | Open |
|
Wrangler
Sorona · Bug bounty |
– | $1,875 | $938 | $313 | $1,875 | Partial | – | 10 days promised | Open |
|
Cloudflare Agents SDK
Sorona · Bug bounty |
– | $1,875 | $938 | $313 | $1,875 | Partial | – | 10 days promised | Open |
|
cloudflared
Sorona · Bug bounty |
– | $1,875 | $938 | $313 | $1,875 | Partial | – | 10 days promised | Open |
|
CloudFlare
Self-hosted · Disclosure only |
– | – | – | – | No cash | None | – | – | Open |
-
- Critical
- $10k (highest)
- High
- $3,000
- Medium
- $750
- Low
- $500
- Safe harbor
- Partial
- First response
- 9 hours average
-
- Critical
- –
- High
- $3,750 (highest)
- Medium
- $938 (highest)
- Low
- $625 (highest)
- Safe harbor
- Partial
- First response
- 10 days promised
-
- Critical
- –
- High
- $1,875
- Medium
- $938
- Low
- $313
- Safe harbor
- Partial
- First response
- 10 days promised
-
- Critical
- –
- High
- $1,875
- Medium
- $938
- Low
- $313
- Safe harbor
- Partial
- First response
- 10 days promised
-
- Critical
- –
- High
- $1,875
- Medium
- $938
- Low
- $313
- Safe harbor
- Partial
- First response
- 10 days promised
-
- Safe harbor
- None
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Cloudflare owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
104 targets across all 7 programs, each listed once with the programs that cover it. 70 excluded.
-
https://developers.cloudflare.com/cloudflare-one/connections/connect-networks
Web
Covered by cloudflared
-
Auto-update and binary-integrity paths, where a downgrade or substituted binary turns into persistent access
Products and areas
Covered by cloudflared
-
Bundling of untrusted project source through the esbuild integration, and everything the build step runs on the developer's machine
Products and areas
Covered by Wrangler
-
Certificate transparency plumbing: SCT submission, retrieval and verification
Products and areas
Covered by cfssl
-
Cloudflare covers this one twice over. The bountied org-wide GitHub assets put cloudflare/cloudflared on the Tier 2 open-source row, capped at $3,500 for a Critical, and the bountied Cloudflare Tunnel product asset covers the service the daemon implements. The connector is in scope as a whole
Products and areas
Covered by cloudflared
-
Cloudflare declares its open-source scope org-wide: any Cloudflare-published project under github.com/cloudflare is bounty-eligible on the Tier 2 open-source row, capped at $3,500 for a Critical. cloudflare/cfssl is covered by that asset and again by Open source tools from Cloudflare, and it is absent from the short list of repositories Cloudflare marks ineligible, so the repository is in scope as a whole
Products and areas
Covered by cfssl
-
Cloudflare declares its open-source scope org-wide: any Cloudflare-published project under github.com/cloudflare is bounty-eligible on the Tier 2 open-source row, capped at $3,500 for a Critical. cloudflare/workers-sdk, the repository that ships Wrangler, sits under that asset and is actively maintained, so it clears the archived and experimental carve-out. The policy adds a section for open-source libraries asking that impact be shown in a supported or realistic deployment
Products and areas
Covered by Wrangler
-
Cloudflare declares its open-source scope org-wide: any non-archived Cloudflare-published project under github.com/cloudflare is bounty-eligible on the open-source row, capped at $3,500 for a Critical. Both repositories behind this stack sit there, cloudflare/agents and cloudflare/mcp-server-cloudflare, and neither appears on the list Cloudflare marks ineligible
Products and areas
Covered by Cloudflare Agents SDK
-
cloudflare/agents as a whole: the Agent class, the Durable Object it runs on, the SQL storage API exposed to agent code, and the state persistence behind both
Products and areas
Covered by Cloudflare Agents SDK
-
cloudflare/mcp-server-cloudflare as a whole: the OAuth authorisation flow, the account and token brokering behind it, and each individual MCP server that turns a Cloudflare account operation into a tool call
Products and areas
Covered by Cloudflare Agents SDK
-
cloudflared access and the client paths behind it: browser login, short-lived certificate issuance, token caching, and the SSH and TCP forwarding it sets up
Products and areas
Covered by cloudflared
-
Configuration handling across the YAML config file, the command-line flags, and remotely managed configuration pushed down from Cloudflare
Products and areas
Covered by cloudflared
-
Configuration handling: wrangler.toml and wrangler.jsonc parsing, environment selection, and how an account and a project get resolved
Products and areas
Covered by Wrangler
-
CSR generation and parsing, X.509 and ASN.1 decoding, and the helpers that read PEM and DER supplied by a caller
Products and areas
Covered by cfssl
-
Durable Objects in full: runtime semantics, the storage API, alarms, and the isolation between clients and sessions talking to the same object
Products and areas
Covered by workerd
-
Ingress rule parsing and origin selection, and the proxying that follows it into HTTP, TCP, SSH, RDP, unix-socket and bastion origins
Products and areas
Covered by cloudflared
-
OAuth device-flow login and API-token storage in the local config directory, including any path by which another local process or a hostile project reads a token
Products and areas
Covered by Wrangler
-
Private network routing, the path that publishes whole IP ranges to WARP clients rather than a single hostname
Products and areas
Covered by cloudflared
-
Request routing into an agent instance, covering routeAgentRequest, the HTTP handlers, the WebSocket upgrade path, and the naming that decides which agent a request reaches
Products and areas
Covered by Cloudflare Agents SDK
-
Scheduling and alarms, where work is queued now to run later under an identity chosen at queue time
Products and areas
Covered by Cloudflare Agents SDK
-
Secret management commands and the bindings that expose those secrets to a deployed Worker
Products and areas
Covered by Wrangler
-
Signing itself: the local signer, the remote signer client, profile and policy enforcement, and the certificate a request finally produces
Products and areas
Covered by cfssl
-
The auth-key mechanism on the signing API, the check that stands between a network caller and a certificate authority key
Products and areas
Covered by cfssl
-
The binding layer that glues V8 to the C++ runtime, where a type or lifetime mistake crosses the JavaScript boundary
Products and areas
Covered by workerd
-
The bindings workerd implements for a Worker to reach other services, including service bindings, queues and the KV, R2 and D1 interfaces the runtime exposes
Products and areas
Covered by workerd
-
The built-in AI Playground UI, which is served from the same origin as the agent it drives
Products and areas
Covered by Cloudflare Agents SDK
-
The bundler and its chain construction, the OCSP responder and its revocation answers, and CRL generation
Products and areas
Covered by cfssl
-
The certificate database and the queries behind it, where issued certificates and revocation state are recorded
Products and areas
Covered by cfssl
-
The CFSSL API server and every endpoint it answers on, including sign, authsign, newcert, newkey, bundle, info, certinfo, init_ca, revoke, ocspsign and health
Products and areas
Covered by cfssl
-
The client SDK and React hooks that connect a browser to an agent, including how they authenticate and what they accept back from the server
Products and areas
Covered by Cloudflare Agents SDK
-
The command-line tools shipped with the server, including cfssl, cfssljson and multirootca, and the config and profile files they parse
Products and areas
Covered by cfssl
-
The inspector and devtools endpoint workerd opens, and the local development paths wrangler dev drives through it
Products and areas
Covered by workerd
-
The management, diagnostics and metrics endpoints the connector exposes on its host
Products and areas
Covered by cloudflared
-
The MCP client and server helpers in the SDK, including tool registration and the transports they speak
Products and areas
Covered by Cloudflare Agents SDK
-
The Node.js compatibility shims exposed under nodejs_compat, where a shim can hand back more capability than the real API would
Products and areas
Covered by workerd
-
The other packages published from the same monorepo, including Miniflare, the create-cloudflare scaffolder and the Vite plugin, all of which run on a developer machine holding the same credentials
Products and areas
Covered by Wrangler
-
The QUIC and HTTP/2 transport back to Cloudflare's edge, including certificate validation, connector registration and reconnection on that leg
Products and areas
Covered by cloudflared
-
The resource commands that reach the Cloudflare API on the developer's behalf, covering KV, R2, D1, queues, Pages and wrangler tail log streaming
Products and areas
Covered by Wrangler
-
The TLS scanning package and the transport helpers that fetch, rotate and validate certificates on a caller's behalf
Products and areas
Covered by cfssl
-
The whole Workers runtime API surface: fetch, Request/Response, Headers, streams, WebSocket, the Cache API, WebCrypto, URL and text encoding, timers and everything else a Worker can call
Products and areas
Covered by workerd
-
The workerd server binary: process startup, socket and service wiring, and the Cap'n Proto configuration and control plane an embedder feeds untrusted config into
Products and areas
Covered by workerd
-
The wrangler deploy publish pipeline: what code, configuration, bindings and secrets the CLI actually uploads, and which credentials it uploads them with
Products and areas
Covered by Wrangler
-
Tunnel credential and token handling end to end: the login flow, cert.pem, connector tokens, and how each is written to and read from disk
Products and areas
Covered by cloudflared
-
V8 isolate lifecycle management, isolate boundaries, and any state that survives a request or crosses between tenants sharing a machine
Products and areas
Covered by workerd
-
WebAssembly hosting inside a Worker, including the boundary between guest module and host runtime
Products and areas
Covered by workerd
-
workerd is one of the few Cloudflare repositories the program names on its own. The live scope table carries github.com/cloudflare/workerd as a SOURCE_CODE asset, bounty-eligible at a maximum severity of critical, with no binding to the reduced open-source row, so the default ladder up to $10,000 applies. The declaration is the repository itself rather than a hosted wrapper around it, and it covers the runtime as a whole
Products and areas
Covered by workerd
-
wrangler dev and the local runtime bridge, including the inspector and dev-server endpoints it opens and the remote-development tunnel
Products and areas
Covered by Wrangler
No target matches. Try part of a host name, such as the company name.
Out of scope 70
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.plugins.realtime.cloudflare.com
HackerOne
-
api.staging.realtime.cloudflare.com
HackerOne
-
app.dyte.io
HackerOne
-
community.cloudflare.com
HackerOne
-
demo.realtime.cloudflare.com
HackerOne
-
events.www.cloudflare.com
HackerOne
-
examples.realtime.cloudflare.com
HackerOne
-
files.plugins.realtime.cloudflare.com
HackerOne
-
https://php-rce.cloudflare.app
HackerOne
-
https://playground.ai.cloudflare.com
HackerOne
-
https://vibecoder.cloudflare.dev
HackerOne
-
react-examples.realtime.cloudflare.com
HackerOne
-
support.cloudflare.com
HackerOne
-
support.cloudflarewarp.com
HackerOne
-
test.realtime.cloudflare.com
HackerOne
-
waf.cumulusfire.net
HackerOne
-
https://github.com/cloudflare/agentic-inbox
HackerOne
-
https://github.com/cloudflare/boringtun
HackerOne
-
https://github.com/cloudflare/cf
HackerOne
-
https://github.com/cloudflare/cloudflare-os
HackerOne
-
https://github.com/cloudflare/computer
HackerOne
-
https://github.com/cloudflare/moq-rs
HackerOne
-
https://github.com/cloudflare/pp-browser-extension
HackerOne
-
https://github.com/cloudflare/privacy-gateway-server-go
HackerOne
-
https://github.com/cloudflare/realtimekit-web-examples
HackerOne
-
https://github.com/cloudflare/recapn
HackerOne
-
https://github.com/cloudflare/saffron.git
HackerOne
-
https://github.com/cloudflare/security-audit-skill
HackerOne
-
https://github.com/cloudflare/templates
HackerOne
-
https://github.com/cloudflare/vibesdk
HackerOne
-
https://github.com/cloudflare/vinext-private
HackerOne
-
172.65.0.0/16
HackerOne
-
Archived, demo-only and experimental repositories under the Cloudflare org, which the policy treats as Informational
Wrangler
-
Attacks that need local root on the connector host, which the program treats as already-lost ground
cloudflared
-
Billing and plan-enforcement issues, which the policy caps at Low severity and a $250 maximum payout
workerd
-
Credential findings validated by actually signing in with the credential, which the program's secret-handling rules forbid
cloudflared
-
Customer-configured Workers and customer content on Cloudflare's edge, which belong to the customer rather than to Cloudflare and are not the researcher's to test
Cloudflare Agents SDK
-
Demo, example and test code carried inside the repository
cfssl
-
Denial of service against Cloudflare
Wrangler
-
Denial of service against Cloudflare's edge
cloudflared
-
Denial of service against Cloudflare, social engineering, and physical attacks
Cloudflare Agents SDK
-
Duplicates of findings Cloudflare's internal AI-assisted scanning has already produced
cfssl
-
Findings against forks or third-party tunnel wrappers rather than the upstream connector
cloudflared
-
Findings submitted without a working proof of concept, which are ineligible at any severity
cfssl
-
Findings that require a maintainer to approve a GitHub Actions workflow before they trigger
workerd
-
Hardening or standards-conformance issues without a demonstrated security impact
cfssl
-
Hardening-only findings with no demonstrated crossing of a security boundary
Cloudflare Agents SDK
-
Issues requiring a consumer application to misuse the library in an obviously unsafe way
Wrangler
-
Issues that were already publicly known at the time of the report
Cloudflare Agents SDK
-
Local-only wrangler dev reproductions with no demonstrated production reachability
workerd
-
Misconfigured user ingress rules that expose an origin exactly as the operator configured them to
cloudflared
-
Pure API incompatibilities, standards deviations, or missing hardening in open source projects without demonstrated security impact
Wrangler
-
Reports only affecting self-hosted or local deployments where Cloudflare production or documented production usage is not impacted
Wrangler
-
Reports that do not clearly identify the affected asset, security boundary, attacker prerequisites, reproduction steps, and meaningful impact
Cloudflare Agents SDK
-
Reports with no working proof of concept, which are not bounty-eligible at any severity
workerd
-
Self-hosted-only impact with no Cloudflare production nexus or documented production usage
cfssl
-
Severity cap to plan around: the open-source row tops out at $3,500 for a Critical, and the Tier 1 band reaching $10,000 covers production Cloudflare infrastructure as discretionary uplift
Wrangler
-
Severity cap to plan around: the open-source row tops out at $3,500 for a Critical, since the $10,000 headline belongs to Tier 1 production Cloudflare infrastructure
Cloudflare Agents SDK
-
Severity cap to plan around: the org-wide open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org
cfssl
-
Severity cap to plan around: the Tier 2 open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org
cloudflared
-
Source-code-only analysis with no runnable reproduction, which is closed Informational regardless of how the severity reads on paper
Wrangler
-
Source-code-only analysis, which the policy rules out however the code reads
cfssl
-
Testing anyone else's tunnel: stand up your own connector and your own origin, since other tenants are off limits
cloudflared
-
The repositories Cloudflare marks explicitly ineligible for bounty: cloudflare/vinext-private, moq-rs, privacy-gateway-server-go, saffron, realtimekit-web-examples and recapn
Cloudflare Agents SDK
-
The repositories Cloudflare marks explicitly not eligible for bounty: cloudflare/vinext-private, moq-rs, privacy-gateway-server-go, saffron and recapn
workerd
-
The workerd runtime itself, which is its own separately named scope asset and is reported against that scope rather than this one
Wrangler
-
The workerd runtime underneath, which the program lists as its own scope asset on a higher reward row and which belongs in a separate report
Cloudflare Agents SDK
-
Third-party Go dependency CVEs without a demonstrated reachable path through cloudflared itself
cloudflared
-
Turnstile
HackerOne
-
V8 itself, which is Chrome VRP territory and already sits on the sorona.xyz paid rail as its own program
workerd
Recent changes
Reward and scope changes across every Cloudflare program, newest first.
-
Scope + HackerOne
Added to scope: https://github.com/cloudflare/boringtun
Recent CVEs
Published vulnerabilities in Cloudflare products, from the NVD.
-
CVE-2026-12523 High
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame type
-
CVE-2026-12523 High
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame type
-
CVE-2026-12523 High
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame type
-
CVE-2026-12523 High
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame type
-
CVE-2026-12523 High
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame type
-
CVE-2026-12523 High
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame type
-
CVE-2026-2835 Critical
An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora’s request framing from backend servers’
-
CVE-2026-2833 Critical
An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the bytes on the connection to a backend before the backend has accepted the upgrade. An attacker can thus directly forward a malicious payload after a req
About this page
This page gathers every public program listed under cloudflare.com and the companies Cloudflare owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Cloudflare.
Something wrong or missing? Report a correction.