CoreDNS

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. CoreDNS qualifies at Tier 2 through its OSS-Fuzz integration, whose project directory is named go-coredns, so the ceiling is $5,000 and not the $15,000 Tier 1 headline. Patches must be one to twelve months old at submission, three a month per person, and sanctions and territory exclusions apply. CVE history 9 Last 12 months 15 Lifetime Denial of service 40 % Access control 20 % Parsing/validation 20 % Info disclosure 15 % Latest advisories Loading the feed Overview CoreDNS is the default DNS server for Kubernetes, so it is the name-resolution layer inside effectively every cluster running today: EKS, GKE, AKS, on-premise distributions, k3s and every developer's laptop cluster. Every service-to-service call in a microservice architecture goes through it. That changes what a bug means. A cache-poisoning or plugin-authorisation defect redirects internal service traffic, the cleanest lateral-movement primitive a container platform offers. CoreDNS is explicitly out of scope for the Kubernetes bounty, which tells reporters to use CoreDNS's own disclosure process, and that process pays nothing. sorona.xyz pays you directly on qualified, reproduced findings. In scope The project takes security reports at [email protected] and through GitHub private advisory reporting, and draws no boundary narrower than the main CoreDNS repository itself The DNS server core and the miekg/dns layer it is built on, where every query and every upstream answer is decoded The whole bundled plugin chain rather than the handful of plugins that happen to carry a CVE, forward, cache, rewrite and template among them The kubernetes plugin in full: it reads live Service and Endpoint state, and it is the place where a namespace boundary is expressed as a DNS boundary and can therefore be crossed Caching and forwarding behaviour end to end, covering which answer from which source is served to which client Every server transport the daemon speaks, including the DoH, DoT and gRPC listeners The Corefile parser and the plugin ordering it produces, which decides what runs before what on every query Out of scope Kubernetes itself and other CNCF components, which are different projects and are not covered by this program Cluster misconfiguration such as an over-permissive kubernetes plugin zone, which is an operator decision Third-party plugins that are not in the main CoreDNS repository DNS amplification treated as an operational property of the protocol rather than as a defect in CoreDNS One-line patches that fix non-exploitable crashes, including crashes that only amount to resource exhaustion, which the Patch Rewards rules say will not generally be rewarded Most-valued findings A remotely triggerable crash or unbounded resource consumption in the query path, which is 40% of this project's history and takes cluster DNS down for every workload at once Cache poisoning across the cache or forward plugins, which redirects internal service-to-service traffic and is the cleanest lateral-movement primitive a cluster offers An authorisation defect in the kubernetes plugin where a namespace boundary fails to hold, so one tenant resolves or enumerates another's services Message-parsing flaws in the DNS parser and the miekg/dns layer reachable from a hostile upstream answer through the forward plugin, since that input comes from outside the cluster entirely Information disclosure through the kubernetes plugin's zone-transfer or wildcard resolution, which turns cluster DNS into a service and endpoint inventory for anyone who can query it Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report to [email protected] or through GitHub's private advisory reporting, with the Corefile and query sequence that triggers it Report CoreDNS bugs here rather than to the Kubernetes program, which places CoreDNS explicitly out of scope and redirects to this process. There is no double-submission to make An over-permissive kubernetes plugin zone or other cluster misconfiguration is an operator decision rather than a defect in CoreDNS If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month. That is a separate pathway with its own rules On that pathway CoreDNS is Tier 2 through OSS-Fuzz, so the patch ceiling is $5,000 rather than the $15,000 Tier 1 headline; patches must be one to twelve months old and are capped at three per person per month Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the CoreDNS maintainers through [email protected] and GitHub security advisories, which is a published process with a real cadence. Patch Rewards imposes no confidentiality or embargo term of its own, so timing is upstream's call; hold the detail until the advisory and release are out, since managed Kubernetes providers roll CoreDNS on their own schedule. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability