Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

prometheus.io Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • Prometheus

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 5 excluded.

  • https://prometheus.io

    Web

  • Configuration and reload handling, including anything that changes what the server scrapes, stores or exposes

    Products and areas

  • PromQL, meaning the query parser and the evaluator, which is the highest-value untrusted-input surface here

    Products and areas

  • Service discovery integrations as a whole, which parse responses from Kubernetes, Consul, EC2 and a long list of other APIs while the server holds broad RBAC

    Products and areas

  • That repository in full: the TSDB, the scrape manager, the rule and alerting engine, the HTTP API and the web UI

    Products and areas

  • The expression browser and console-template rendering, historically an XSS surface

    Products and areas

  • The remote-read and remote-write protocol handlers, which accept protobuf and snappy payloads from other systems

    Products and areas

  • The scrape path in full, covering the exposition-format parsers and the credentials the server presents to every target it scrapes

    Products and areas

  • The security team takes reports at [email protected] or through GitHub private advisory reporting, covering the Prometheus server itself. The Google patch pathway is narrower still and reaches github.com/prometheus/prometheus only

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Grafana, Thanos, Mimir, Cortex and VictoriaMetrics, which are separate projects even where they speak the Prometheus protocol

  • Hosted Prometheus services such as Grafana Cloud, AWS Managed Prometheus and Google Managed Prometheus, which are vendor-operated products rather than this repository

  • One-line fixes for non-exploitable crashes and resource-exhaustion denial of service, which the Patch Rewards rules exclude by name

  • Patches outside the one-to-twelve-month age window the rules impose

  • prometheus/alertmanager, prometheus/node_exporter, prometheus/client_golang and the exporters, none of which has an OSS-Fuzz project directory, so none is Tier 2 eligible. The boundary is per repository, and getting it wrong invents coverage that does not exist

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2026-44903 Medium

    Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execu

  • CVE-2026-42151 High

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azu

  • CVE-2026-42154 High

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust ava

  • CVE-2026-40179 Medium

    Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names co

  • CVE-2023-40577 High

    Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

  • CVE-2023-26735 High

    blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources. NOTE: this is disputed by third parties because authentication can be configured.

  • CVE-2022-46146 Medium

    Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use thi

  • CVE-2022-21698 High

    client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be af

About this page

This page gathers every public program listed under prometheus.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.