Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

libvirt bug bounty programs

libvirt.org Updated

Libvirt runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program libvirt runs.

  • libvirt

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 5 excluded.

  • https://libvirt.org

    Web

  • Authentication and access control in full, covering UNIX socket permissions, SASL, the TLS transports and the polkit policy layer

    Products and areas

  • Domain XML parsing and generation across every driver, including the paths that turn XML into a hypervisor command line

    Products and areas

  • Migration in full: the source and destination handshake, the transport and the state a receiving host accepts

    Products and areas

  • Secret handling, covering the secret driver and any credential libvirt holds on a guest's behalf

    Products and areas

  • The language bindings shipped by the project, including libvirt-python

    Products and areas

  • The libvirtd daemon and the split modular daemons that replaced it, including virtqemud, virtstoraged, virtnetworkd and the rest of the set

    Products and areas

  • The network and nwfilter drivers, including the firewall rules libvirt generates on the host

    Products and areas

  • The non-QEMU drivers (LXC, Xen, bhyve and the others), which share the same daemon and the same privilege

    Products and areas

  • The published security process accepts confidential GitLab work items, where the security team handles triage, CVE allocation and embargo. It declares no component boundary, so the whole management stack is in

    Products and areas

  • The QEMU driver and the QMP monitor conversation, plus how libvirt sets up the confinement of the QEMU process it launches

    Products and areas

  • The RPC protocol end to end: the wire format, XDR decoding and every API entry point it dispatches to

    Products and areas

  • The storage driver set: pools, volumes, disk image handling and anything that probes or rewrites image metadata

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Defects in QEMU, Xen or another hypervisor rather than in libvirt's handling of it

  • Deliberate administrator configuration, such as granting an ordinary user access to the read-write system socket

  • Distribution packaging and downstream patches

  • Issues already published in the libvirt security notice repository

  • SELinux or AppArmor policy shipped by a distribution rather than by libvirt

Recent changes

Reward and scope changes across every libvirt program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in libvirt products, from the NVD.

Search NVD
  • CVE-2015-5160 Medium

    libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.

  • CVE-2014-3633 Medium

    The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query, which triggers an out-of-bounds read.

  • CVE-2014-3657 Medium

    The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

  • CVE-2010-2239 Medium

    Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors.

  • CVE-2010-2242 Low

    Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by leveraging IP address and source-port values, as demonstrated by copying and deleting an NFS directory tree.

  • CVE-2010-2237 Medium

    Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores without referring to the user-defined main disk format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.

  • CVE-2010-2238 Medium

    Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.

  • CVE-2009-0036 Medium

    Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.

About this page

This page gathers every public program listed under libvirt.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.