Dynatrace Operator

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (All other Assets row; the GitHub assets are not Core Assets) │ $1,500 │ $1,875 High │ $500 │ $625 Medium │ $250 │ $313 Low │ $100 │ $125 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 35 % Code execution 25 % Info disclosure 25 % Auth bypass 12 % Latest advisories Loading the feed Overview The Dynatrace Operator is how Dynatrace gets into Kubernetes, and where it is installed it is installed across the whole estate, because full-fleet coverage is the entire point. It runs a mutating webhook that injects the OneAgent init container into workloads cluster-wide and a privileged CSI driver on every node to mount the agent code modules, which is about as privileged as a third-party component gets in a cluster; it also holds the Dynatrace tenant API token in cluster secrets, so an information-disclosure bug here is a pivot into a customer's entire observability tenant and the traces, logs and request payloads it collects. The GitHub star count is a poor proxy for reach, since this is enterprise software installed from Helm charts and the Red Hat OperatorHub by banks, insurers, telcos and government. Dynatrace pays it on HackerOne as a named source-code asset, on the "All other Assets" row that tops out at $1,500 for a Critical, and sorona.xyz adds 1.25× on top of whatever Dynatrace awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~3 hours First response ~6 days Triage ~8 days Bounty In scope The program lists github.com/Dynatrace/dynatrace-operator as its own source-code asset, eligible for bounty and submission at up to critical severity, and names it again on the twelve-repository whitelist attached to the github.com/Dynatrace asset. The whole repository is in scope, priced on the "All other Assets" row The operator controller and everything it reconciles: the DynaKube and EdgeConnect custom resources, their validation and defaulting, and the workloads the operator creates from them The mutating webhook that injects the OneAgent init container into workloads cluster-wide, its admission logic, and the certificate and admission-configuration handling behind it The CSI driver the operator ships to mount the OneAgent code modules into application pods, which runs privileged on every node Secret and API-token handling for the Dynatrace tenant credentials the operator keeps in cluster secrets, including how they are fetched, refreshed and passed to the components it deploys The operator's outbound client to the Dynatrace tenant: endpoint and proxy configuration, TLS, and how it treats what comes back The RBAC, deployment manifests and CRD definitions the repository ships, which decide what privileges the operator holds once it is installed Out of scope Reports from accounts below 150 HackerOne reputation, the gate Dynatrace attaches to its GitHub assets. Below it a report is closed as Informative without review Anything that requires you to test against github.com. Source-code analysis is the only permitted method on these assets Third-party software and protocols not under Dynatrace's control, including dependency CVEs without a chain through the operator's own code The easyTravel and easyTrade demo applications, which are explicitly marked not bounty-eligible github.com/Dynatrace-oss-contrib and github.com/Dynatrace-innovationlab , both carrying eligible_for_bounty: false and max_severity: none The generic exclusion list: missing security headers, self-XSS, scanner output, TLS cipher reports, CSP issues, DKIM/SPF/DMARC findings, and CSRF without a demonstrated sensitive action The corporate site *.dynatrace.com , out of scope outright, and the hosted *.sprint.dynatracelabs.com and myaccount environments, which are separate assets on the same program and need a requested testing tenant Most-valued findings Container escape or node compromise through the privileged CSI driver, the shortest route to a Critical here because the driver runs on every node in the cluster A cluster-wide access-control failure in the mutating webhook that injects attacker-controlled content into workloads across namespaces, the largest expected class at 35%, including certificate or admission-configuration handling that lets a hostile pod through uninjected or injected with attacker-chosen content Code execution in the controller reached from a DynaKube or EdgeConnect resource that a namespace-scoped user is allowed to create Disclosure of the Dynatrace tenant API token out of cluster secrets, which turns a cluster-local bug into access to the customer's observability tenant Authentication bypass on the operator's own endpoints or the webhook, letting an unauthenticated caller reach privileged reconciliation Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. You need at least 150 HackerOne reputation to submit against the GitHub assets; below that the report is closed as Informative without review Source-code analysis only, and no testing against github.com itself Sanctions screening applies and you must be 18 or over The paid asset is the operator's own source, not the Dynatrace SaaS tenant it reports into, so keep the impact inside the cluster component Dynatrace asks you to treat everything about the vulnerability as confidential unless it gives prior written consent to share it Program stats 368 Reports resolved $185k Bounties paid 83% Response efficiency Disclosure Coordinated through Dynatrace. The program treats vulnerability information as confidential and requires prior written consent before anything reaches a third party or the public, and publishes no disclosure clock, so timing is Dynatrace's call rather than a fixed window. sorona.xyz holds your finding until Dynatrace has shipped a fix. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability