Cluster Autoscaler

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 2 asset) │ $5,000 │ $6,000 High │ $2,500 │ $3,125 Medium │ $500 │ $625 Low │ $100 │ $125 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 35 % Denial of service 30 % Auth bypass 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Cluster Autoscaler is one of the very few Kubernetes add-ons that essentially every managed provider vendors and runs on its customers' behalf: EKS, GKE, AKS, OpenShift and most on-prem distributions ship it as the default node-scaling mechanism, so this repo's code executes in the control plane of an enormous fraction of the world's production clusters, including plenty whose operators have never heard of it. Its privilege position is high by necessity, because it must read every pod and node in the cluster to run scheduling simulations and it must create and delete cloud instances, which is the most consequential permission any in-cluster component holds, while the Vertical Pod Autoscaler shipped in the same repo adds a cluster-wide mutating admission webhook on top. Denial of service matters here in a way it does not elsewhere: an autoscaler tricked into scaling to zero is an outage, and one tricked into unbounded scale-up is a direct financial attack on the cluster owner's cloud bill. The zero-CVE history should be read as under-researched rather than safe. The CNCF pays it on the Kubernetes program at HackerOne as a Tier 2 asset, $100 at Low rising to $5,000 at Critical, and sorona.xyz adds 1.25× on top of whatever the CNCF awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 1 business day First response 10 business days Triage 10 business days Bounty In scope The kubernetes/autoscaler repository, which the program lists as a bounty-eligible source-code asset up to critical severity under the instruction "Autoscaling components for Kubernetes", priced at Tier 2: $100 at Low rising to $5,000 at Critical Cluster Autoscaler itself, in full: the scale-up and scale-down loop, node-group discovery and registration, the expanders that pick which group grows, and the simulated scheduling that decides whether a pending pod fits The provider-neutral cloud interface at the centre of that loop, meaning the node-group abstraction and the instance create and delete authority the autoscaler exercises through it How the component talks to the API server: its informers and its cluster-wide read over pods, nodes, PodDisruptionBudgets and events, plus the flags and configuration that govern them The Vertical Pod Autoscaler shipped in the same repository, all three parts of it: the recommender, the updater and the cluster-wide mutating admission webhook addon-resizer , the third component in the repository the program pays on Out of scope The roughly 30 per-cloud provider implementations in the same repository, which the program treats as vendor-specific plugins and does not pay for Anything in kubernetes/autoscaler beyond the core autoscaling loop, the Vertical Pod Autoscaler and addon-resizer, since those are the components the program pays on Attacks relying on insecure configurations, subject to the Security Response Committee's opinion Kubernetes on Windows or other non-Linux platforms Deprecated components, which are not supported targets Releases outside the three most recent, which the Kubernetes program does not treat as supported Reports from a maintainer, or from the author or reviewer of the vulnerable code, which the program cannot award Most-valued findings A workload-controlled input that makes the autoscaler create or delete nodes it should not. That ends in cloud-instance authority, the access-control class and the realistic route to the $5,000 Critical row Node-group discovery driven by an attacker-influenced label, taint or annotation, so the autoscaler acts on a group it was never meant to touch Tricking the loop into scaling a node group to zero, taking down everything on it, or into unbounded scale-up, a direct financial attack on the cluster owner's bill Abuse of the Vertical Pod Autoscaler's cluster-wide mutating admission webhook to alter pod specs across namespaces A crash or wedge in the scheduling simulation reachable from an ordinary pod spec, which halts all scaling cluster-wide Leakage of node, pod or cloud-credential detail through the autoscaler's logs, metrics or status output Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only the core autoscaling loop, the Vertical Pod Autoscaler and addon-resizer pay; the roughly 30 per-cloud provider implementations in the same repo are excluded as vendor-specific plugins A supply-chain finding that alters source code or release artifacts escalates to Tier 1 and USD 10,000 Attacks that rely on an insecure configuration are judged at the Security Response Committee's discretion Non-Linux platforms and deprecated components are not supported targets The public disclosure date is negotiated with the Kubernetes Security Response Committee rather than set by you Program stats 141 Reports resolved $112k Bounties paid 60% Response efficiency Disclosure Coordinated through the Kubernetes Security Response Committee, which negotiates a public disclosure date with the reporter and prefers full disclosure once user mitigation is available. Because every managed provider ships this component, mitigation usually means a release each of them can pick up, so sorona.xyz holds your finding until that agreed date. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability