Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Samba bug bounty programs

samba.org Updated

Samba runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Samba runs.

  • Samba

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 6 excluded.

  • https://www.samba.org

    Web

  • ctdb clustering and the state it shares between nodes, where a code defect rather than an operational preference is at issue

    Products and areas

  • Samba's own client side, which parses whatever a server sends back; the exclusion below is for Windows-side defects reached through it rather than for the client code itself

    Products and areas

  • The Active Directory domain controller in full: LDAP, the Kerberos KDC, DRSUAPI replication, the DsCrackNames family and the directory backend underneath them

    Products and areas

  • The file server in full: the SMB1, SMB2 and SMB3 protocol implementation in smbd, reachable pre-authentication on TCP/445 from any host that can route to the machine

    Products and areas

  • The RPC layer generated from IDL and the ndr marshalling code underneath it, which decodes attacker-supplied wire structures for every service built on the generated stubs

    Products and areas

  • The Samba Team takes reports at [email protected] and runs a long-standing coordinated process over upstream Samba. The lines it draws are other vendors' code and libraries with their own scope rows, so the Samba tree itself is what a researcher works against

    Products and areas

  • The VFS module set as a whole, vfs_fruit for macOS interoperability included, covering path handling and extended-attribute processing

    Products and areas

  • winbindd and the NSS and PAM integration boundary, where a string controlled by the domain crosses into a local privileged process

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Bugs that actually live in a linked library with its own scope row, such as OpenLDAP, MIT krb5 or GnuTLS

  • Configuration mistakes rather than code defects: world-writable shares, map to guest = bad user, signing turned off

  • ctdb clustering behaviour that is correct but operationally undesirable

  • One-line fixes for non-exploitable crashes, which the reward panel excludes

  • Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail

  • Windows-side or Microsoft Active Directory bugs reached through Samba's client rather than defects in Samba itself

Recent changes

Reward and scope changes across every Samba program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Samba products, from the NVD.

Search NVD
  • CVE-2026-119741 High

    rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender

  • CVE-2026-58224 Medium

    A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of s

  • CVE-2026-70463 High

    rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associat

  • CVE-2026-70464 High

    rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module select

  • CVE-2026-70458 High

    rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent hea

  • CVE-2026-70459 Medium

    rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer

  • CVE-2026-70460 Critical

    rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended

  • CVE-2026-70461 High

    rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, cau

About this page

This page gathers every public program listed under samba.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.