sorona.xyz bug bounty programs
etcd.io Updated
Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 13
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program sorona.xyz runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
etcd
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | 3 days promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
- First response
- 3 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
13 targets. 6 excluded.
-
https://etcd.io
Web
-
etcdctl and etcdutl, the tools that read, write, snapshot and repair a cluster's data
Products and areas
-
The authentication subsystem end to end: users, roles, key-range permissions, the simple and JWT token providers, and the enable and disable transitions
Products and areas
-
The bbolt storage backend as etcd uses it, plus the MVCC layer, compaction and defragmentation
Products and areas
-
The gateway and proxy modes the project ships
Products and areas
-
The gRPC gateway that exposes the same API over HTTP and JSON, along with the endpoints it derives
Products and areas
-
The metrics, health and debug endpoints the server exposes, and what an unauthenticated caller can read from them
Products and areas
-
The published process asks for any undisclosed vulnerability privately at [email protected] and declares no boundary narrower than the etcd tree itself. Everything below sits inside that
Products and areas
-
The Raft implementation and the peer protocol behind it, including membership reconfiguration and the promotion of learners to voting members
Products and areas
-
The v3 client API over gRPC in full, covering the key-value, watch, lease, lock and election services
Products and areas
-
The write-ahead log, snapshot creation and snapshot restore, all of which parse files a node accepts from another node or from an operator
Products and areas
-
TLS handling on both the client and peer listeners, including client certificate authentication and the mapping from a certificate common name to an etcd identity
Products and areas
-
Watch and lease handling, where a stream established once continues to deliver key events over time
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
An etcd deliberately run without authentication or TLS, which is a deployment decision rather than an etcd defect
-
bbolt, gRPC and the Go standard library as upstream projects, unless etcd's own use of them is what makes the defect reachable
-
Kubernetes itself, which has its own project and its own paid programme
-
Reports filed as public GitHub issues, which take the finding outside the coordinated process
-
Resource consumption from writes an authorised client is permitted to make
-
Third-party etcd operators, Helm charts and packaged distributions
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in sorona.xyz products, from the NVD.
-
CVE-2026-59818 Medium
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener, allowing a client with a revoked certificate to authenticate successfully over gRPC. Thi
-
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach lea
-
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested transactions to bypass all key-level authorization. This allows any authenticated user with direct access to etcd to effectively ignore all key range restrictions, accessing the entire etcd data
-
CVE-2026-33413 High
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, unauthorized users may bypass authentication or authorization checks and call certain etcd functions in clusters that expose the gRPC API to untrusted or partially trusted clients. In unpatched etcd clusters with etcd auth enabled, unauthorized users are able to call MemberList
-
CVE-2022-34038 High
Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.
-
CVE-2023-32082 Low
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no k
-
CVE-2021-28235 Critical
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.
-
CVE-2020-15112 Medium
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
About this page
This page gathers every public program listed under etcd.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.