Dynatrace OpenTelemetry Collector

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (All other Assets row; the GitHub assets are not Core Assets) │ $1,500 │ $1,875 High │ $500 │ $625 Medium │ $250 │ $313 Low │ $100 │ $125 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Parsing/validation 35 % Denial of service 25 % Info disclosure 25 % Access control 10 % Latest advisories Loading the feed Overview This is Dynatrace's supported distribution of the OpenTelemetry Collector: upstream collector components plus Dynatrace's own processors and exporters. In absolute terms the repository is small, and the entry does not pretend otherwise at 43 GitHub stars, but its significance is entirely downstream: Dynatrace is one of the three largest commercial observability vendors, with tens of thousands of enterprise customers concentrated in banking, insurance, telco, healthcare and government, and this collector is the officially supported ingestion path for every one of them that chooses OpenTelemetry over the proprietary OneAgent, which is where Dynatrace is steering its base. Each deployed instance sits inside a high-value network, accepts telemetry from every workload in the environment, and holds an API token that writes into that customer's observability tenant, so the threat model is the classic collector one: untrusted input on one side, credentials across a trust boundary on the other. Dynatrace pays it on HackerOne on the "All other Assets" row, which tops out at $1,500 for a Critical and carries a documented $50 quality bonus, and sorona.xyz adds 1.25× on top of whatever Dynatrace awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~3 hours First response ~6 days Triage ~8 days Bounty In scope Dynatrace's source-code asset names twelve repositories individually, dynatrace-otel-collector among them, eligible for bounty and submission at up to critical severity. The whole repository sits inside that declaration, priced on the "All other Assets" row rather than Core Assets The distribution as it ships: the pipeline this repository assembles out of receivers, processors, exporters, extensions and connectors, and the way those components are wired together into a released collector The receiver surface that terminates telemetry from instrumented workloads, whichever protocol is on the other end, since that is the input every deployment exposes Dynatrace's own components, including the transformation and enrichment logic applied to telemetry before it leaves the collector The exporter path into a Dynatrace tenant: API token handling, endpoint selection and TLS on the way out of the customer's network Configuration end to end, meaning config parsing and validation, the sample configurations the repository publishes, and any setting an operator can reach that changes how untrusted telemetry is handled The component manifest and build definition that decide which upstream module versions are compiled in, along with the container images and packages the repository releases Out of scope Reports from accounts below 150 HackerOne reputation. The gate is attached to the Dynatrace GitHub assets and enforced automatically, so a valid finding filed under it is closed as Informative without review Upstream open-telemetry/opentelemetry-collector code, which is Dynatrace's dependency rather than Dynatrace's code. The policy excludes issues in software or protocols outside Dynatrace's control, and the sibling scope instruction names vulnerable libraries Any Dynatrace repository not on the twelve-item whitelist, plus github.com/Dynatrace-oss-contrib and github.com/Dynatrace-innovationlab , both marked ineligible for bounty and submission at max_severity: none Anything that requires you to test against github.com. Dynatrace permits source-code analysis only on these assets The standard exclusion list: missing security headers, CSRF without a sensitive action, self-XSS, scanner output, SSL/TLS cipher reports, DNS and open-port configuration, CSP issues and subdomain takeovers The hosted Dynatrace environments and the corporate site, separate assets on the same program. *.dynatrace.com is marked out of scope outright, and the dynatracelabs.com testing environments need a requested tenant Most-valued findings A parsing or validation flaw in a bundled receiver, reached by telemetry from an ordinary instrumented workload. The top expected class at 35%, and the only surface an unprivileged attacker genuinely controls Denial of service from crafted OTLP, Prometheus or filelog input, since the collector is the single ingestion chokepoint for an entire monitored environment Disclosure of the Dynatrace API token, or of one workload's telemetry to another, through the exporter path or a processor Configuration parsing that lets a hostile config value reach code execution or file access outside the paths the collector was meant to touch An access-control failure in a Dynatrace component that lets telemetry cross a tenant or namespace boundary before export Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A hard 150 HackerOne reputation minimum applies to the GitHub assets and is enforced automatically: reports below the threshold are closed as Informative without review Only source-code analysis is permitted; do not run tests against github.com, and request a testing environment with a @wearehackerone.com address if you need one (they expire after three months) Dynatrace takes a perpetual, irrevocable, transferable, sublicensable, royalty-free licence over any information in your report Check the repository is still on the twelve-item whitelist attached to the github.com/Dynatrace asset before you start, because that list is the scope, not a wildcard Sanctions screening excludes Cuba, Iran, North Korea, Syria, Russia, Belarus, Venezuela, Crimea and the DPR/LPR regions, and you must be 18 or over Program stats 368 Reports resolved $185k Bounties paid 83% Response efficiency Disclosure Coordinated through Dynatrace. The program treats vulnerability information as confidential and requires prior written consent before anything reaches a third party or the public, with no published disclosure clock, so timing is Dynatrace's call. sorona.xyz holds your finding until Dynatrace has shipped a fix. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability