Programs
Companies
Kubernetes

Kubernetes bug bounty programs

kubernetes.io Updated 12 Nov 2026

Kubernetes runs three public programs: a HackerOne bug bounty paying up to $10,000, a Sorona bug bounty paying up to $10,000 and a self-hosted bug bounty.

Top reward: $10,000; HackerOne
Programs: 3; 3 pay cash
Targets in scope: 90; 3 types, deduplicated
Last change: None yet; Tracked since Nov 2026

Where to report

3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Kubernetes

HackerOne · Pays the most of the 3 programs: up to $10,000.

Kubernetes programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.
Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
Kubernetes HackerOne · Bug bounty	$10k (highest)	$5,000 (highest)	$1,000 (highest)	$200 (highest)	$10,000	Full	–	3 hours average	Open
Kubernetes Sorona · Bug bounty	$10k	$5,000	$1,000	$200	$10,000	Partial	–	24 hours promised	Open
Kubernetes Self-hosted · Bug bounty	–	–	–	–	Not published	Full	–	3 days promised	Open

Kubernetes
HackerOne · Bug bounty

Open

Top reward
$10k

Critical

$10k (highest)

High

$5,000 (highest)

Medium

$1,000 (highest)

Low

$200 (highest)

Safe harbor

Full

First response

3 hours average
Kubernetes
Sorona · Bug bounty

Open

Top reward
$10k

Critical

$10k

High

$5,000

Medium

$1,000

Low

$200

Safe harbor

Partial

First response

24 hours promised
Kubernetes
Self-hosted · Bug bounty

Open

Top reward
Not published

Safe harbor

Full

First response

3 days promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

90 targets across all 3 programs, each listed once with the programs that cover it. 8 excluded.

k8s.io

Web Critical

Covered by HackerOne
kubernetes-csi.github.io

Web Critical

Covered by HackerOne
kubernetes.io

Web Critical

Covered by Sorona, HackerOne
prow.k8s.io

Web Critical

Covered by HackerOne
github.com/kubernetes-csi

Source code Critical

Covered by HackerOne
github.com/kubernetes-retired

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes-client

Source code Critical

Covered by HackerOne
https://github.com/kubernetes-incubator

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes-security

Source code Critical

Covered by HackerOne
https://github.com/kubernetes-sigs

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/api

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/apiextensions-apiserver

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/apimachinery

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/apiserver

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/autoscaler

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/cli-runtime

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/client-go

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/cloud-provider

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/cloud-provider-alibaba-cloud

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/cloud-provider-aws

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/cloud-provider-azure

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/cloud-provider-gcp

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/cloud-provider-openstack

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/cloud-provider-sample

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/cloud-provider-vsphere

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/cluster-bootstrap

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/cluster-registry

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/code-generator

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/community

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/component-base

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/cri-api

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/csi-api

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/csi-translation-lib

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/dns

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/enhancements

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/examples

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/frakti

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/funding

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/gengo

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/git-sync

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/k8s.io

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/klog

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kompose

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kops

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kube-aggregator

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kube-controller-manager

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kube-deploy

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kube-openapi

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kube-proxy

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kube-scheduler

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kube-state-metrics

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kubeadm

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kubectl

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kubelet

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kubernetes

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/kubernetes-anywhere

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/kubernetes-template-project

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/legacy-cloud-providers

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/metrics

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/minikube

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/node-api

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/node-problem-detector

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/org

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/perf-tests

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/publishing-bot

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/release

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/repo-infra

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/sample-apiserver

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/sample-cli-plugin

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/sample-controller

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/security

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/sig-release

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/steering

Source code Critical No bounty

Covered by HackerOne
https://github.com/kubernetes/test-infra

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/utils

Source code Critical

Covered by HackerOne
https://github.com/kubernetes/website

Source code Critical

Covered by HackerOne
Admission controllers and Pod Security (PodSecurity admission) enforcement, and bypasses of those policy controls

Products and areas

Covered by Sorona
Code across the Kubernetes GitHub organizations (github.com/kubernetes and kubernetes-sigs) that counts as core, plus CI, release, and documentation artifacts

Products and areas

Covered by Sorona
Community Management & Communications

Products and areas Critical No bounty

Covered by HackerOne
Core Kubernetes, the GA and Beta features of k8s.io/kubernetes and its staging repositories, the core-owned dependencies such as k8s.io/klog, and core addons like kube-proxy (Tier 1)

Products and areas

Covered by Sorona
https://storage.googleapis.com/kubernetes-release/

Products and areas Critical

Covered by HackerOne
k8s.gcr.io

Products and areas Critical

Covered by HackerOne
kube-apiserver, covering authentication, authorization, and admission control, RCE and privilege escalation here are explicitly prioritized

Products and areas

Covered by Sorona
kubelet, where remote code execution and node-level privilege escalation are explicitly prioritized

Products and areas

Covered by Sorona
RBAC and the authorization layer, bugs that grant unexpected permission changes or let an actor escalate across accounts and namespaces

Products and areas

Covered by Sorona
The build and release supply chain of the Kubernetes orgs, gaining unauthorized commit access or publishing unauthorized/malicious artifacts, and the project infrastructure (k8s.io, the prow CI system, documentation) and core alpha features at Tier 3

Products and areas

Covered by Sorona
The remaining control-plane and client components: kube-controller-manager, kube-scheduler, kube-proxy, and kubectl (note the kubectl user-interaction downgrade rule below)

Products and areas

Covered by Sorona
Tier 1

Products and areas Critical

Covered by HackerOne
Tier 2

Products and areas Critical

Covered by HackerOne
Tier 3

Products and areas Critical

Covered by HackerOne

No target matches. Try part of a host name, such as the company name.

Out of scope 8

Don't test these. A program can exclude a host another program covers; the program you report to decides.

https://github.com/kubernetes/ingress-gce

HackerOne
https://github.com/kubernetes/ingress-nginx

HackerOne
Attacks on the Linux kernel underneath the cluster

Sorona
Community-management tooling such as the Kubernetes mailing lists and Slack channels

Sorona
Container escapes and any attack that never routes through a Kubernetes component such as the kubelet

Sorona
Dependencies Kubernetes does not own, such as etcd itself, though an unauthorized or unauthenticated etcd path that is mediated by a Kubernetes component can still qualify

Sorona
Findings that depend on insecure, non-default cluster configurations

Sorona
Other third-party dependencies that live outside the Kubernetes GitHub organizations

Sorona

Recent changes

Reward and scope changes across every Kubernetes program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Kubernetes products, from the NVD.

Search NVD

CVE-2026-13020 High

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for
CVE-2026-13020 High

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for
CVE-2026-13020 High

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for
CVE-2026-13019 Critical

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal fo
CVE-2026-13019 Critical

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal fo
CVE-2026-13019 Critical

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal fo
CVE-2026-33519 Critical

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.
CVE-2026-33519 Critical

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

About this page

This page gathers every public program listed under kubernetes.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.