Cloudflare Agents SDK

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (open-source row, not the $10,000 production tier) │ $3,500 │ $4,375 High │ $1,500 │ $1,875 Medium │ $750 │ $938 Low │ $250 │ $313 Submit a vulnerability CVE history 3 Last 12 months 3 Lifetime Access control 35 % XSS 30 % Info disclosure 20 % Auth bypass 10 % Latest advisories Loading the feed Overview The Agents SDK is the standard way to build stateful agents on Cloudflare Workers, which means every deployment built with it is internet-facing on Cloudflare's edge by construction rather than sitting behind a corporate VPN. Alongside it, cloudflare/mcp-server-cloudflare is one of the most widely connected remote MCP server suites in existence, reachable from Claude, Cursor, VS Code and any other MCP client, and it brokers access to customers' actual Cloudflare accounts. Its published CVE pattern in 2026, an IDOR on header-based email routing and a reflected XSS in the shipped AI Playground, is exactly the profile of a young framework already carrying production traffic. Cloudflare pays these repos on the open-source row, $250 at Low up to $3,500 for a Critical, and sorona.xyz adds 1.25x on top of whatever Cloudflare awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 10 business days First response 10 business days after first response Triage 10 business days after triage Bounty In scope Cloudflare declares its open-source scope org-wide: any non-archived Cloudflare-published project under github.com/cloudflare is bounty-eligible on the open-source row, capped at $3,500 for a Critical. Both repositories behind this stack sit there, cloudflare/agents and cloudflare/mcp-server-cloudflare , and neither appears on the list Cloudflare marks ineligible cloudflare/agents as a whole: the Agent class, the Durable Object it runs on, the SQL storage API exposed to agent code, and the state persistence behind both Request routing into an agent instance, covering routeAgentRequest , the HTTP handlers, the WebSocket upgrade path, and the naming that decides which agent a request reaches Scheduling and alarms, where work is queued now to run later under an identity chosen at queue time The email routing paths the SDK ships The client SDK and React hooks that connect a browser to an agent, including how they authenticate and what they accept back from the server The built-in AI Playground UI, which is served from the same origin as the agent it drives The MCP client and server helpers in the SDK, including tool registration and the transports they speak cloudflare/mcp-server-cloudflare as a whole: the OAuth authorisation flow, the account and token brokering behind it, and each individual MCP server that turns a Cloudflare account operation into a tool call Out of scope Customer-configured Workers and customer content on Cloudflare's edge, which belong to the customer rather than to Cloudflare and are not the researcher's to test The workerd runtime underneath, which the program lists as its own scope asset on a higher reward row and which belongs in a separate report The repositories Cloudflare marks explicitly ineligible for bounty: cloudflare/vinext-private , moq-rs , privacy-gateway-server-go , saffron , realtimekit-web-examples and recapn Issues that were already publicly known at the time of the report Hardening-only findings with no demonstrated crossing of a security boundary Reports that do not clearly identify the affected asset, security boundary, attacker prerequisites, reproduction steps, and meaningful impact Denial of service against Cloudflare, social engineering, and physical attacks Severity cap to plan around: the open-source row tops out at $3,500 for a Critical, since the $10,000 headline belongs to Tier 1 production Cloudflare infrastructure Most-valued findings Access-control failures in the agent runtime that let one user reach another user's agent state or session, the IDOR shape CVE-2026-1664 took on header-based routing Authentication or OAuth flaws in mcp-server-cloudflare that let an MCP client act against a Cloudflare account it was never granted Cross-site scripting in the shipped AI Playground UI, which runs same-origin with the agent and has already produced one published CVE Agent state persisted in a Durable Object leaking across clients, or being written by a client that should not have been able to reach it WebSocket or HTTP routing confusion in the SDK that misattributes a request to the wrong agent instance or the wrong identity Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The open-source row is $250 to $3,500; the headline $10,000 applies to production Cloudflare infrastructure and should not be quoted for these repositories Your report must clearly identify the affected asset, the security boundary, the attacker prerequisites, reproduction steps and meaningful impact, or it is closed Informational or Not Applicable The reward is reduced if the issue is already public knowledge at the time you report it Cloudflare reserves the right to fix hardening issues without awarding anything for them Test your own agent deployment and your own Cloudflare account; customer-owned zones and customer Workers are not yours to test Program stats 376 Reports resolved $568k Bounties paid 77% Response efficiency Disclosure Coordinated with Cloudflare on a bounded clock: nothing may be published for 90 days from submission without prior written approval, and there is no perpetual confidentiality obligation and no IP assignment behind it. Agents SDK findings have been published as named CVEs and GitHub advisories within weeks, so sorona.xyz holds the write-up until the advisory lands or the window closes. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability