Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Fluentd

Bug bounty on Sorona fluentd.org

Accepting reports open-source
Go to program Website
Top reward
$1,500
Top severity paid
Critical
Assets in scope
14
Public CVEs
8
Last change
No changes yet

At a glance

What to know before you start testing.

Pays from $1,500
for critical bugs.
Report on Sorona
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Sorona lists as the payout for each severity.

Severity Reward
Critical $1,500+
High $700+
Medium $300+
Low $100 $100 / 1 month Claude Max
Safe harbor
Partial Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

14 assets you may test, 6 excluded.

Web 1

  • https://www.fluentd.org

Products and areas 13

  • Formatter plugins and the compression and chunking behaviour on the way out
  • Plugin loading, the plugin directory and gem installation as Fluentd performs it
  • Reports go through the GitHub Security Advisory form on fluent/fluentd, and the policy declares no boundary narrower than the Fluentd codebase itself
  • The buffer implementation, both memory and file, including what is written to disk, where and with which permissions
  • The configuration parser: embedded Ruby evaluation, @include handling including remote includes over HTTP, and environment variable expansion
  • The filter plugins, in particular record_transformer and any filter that evaluates a Ruby expression over record content
  • The forward protocol itself, including its handshake, shared key authentication, username and password authentication, and TLS
  • The input plugins shipped in the tree, covering forward, http, tail, syslog, tcp, udp, exec, unix and monitor_agent
  • The output plugins and the credentials each holds for its destination, along with the retry and secondary output paths
  • The parser plugins that run over untrusted log text: json, regexp, ltsv, csv, tsv, apache, apache2, nginx, syslog and multiline
  • The RPC endpoint and the monitor_agent HTTP endpoint, and what each exposes to a caller
  • The supervisor and worker process model, the signal handling between them and the socket manager
  • The tail input's file handling, position file and log rotation logic
Out of scope (6)
  • Fluent Bit, a sibling project with its own repository and its own reporting address
  • fluenthq.com, an unrelated product that shares part of the name
  • fluent-package, the Docker images and the Kubernetes DaemonSet images, which route to their own repositories
  • The destinations logs are forwarded to
  • The Ruby interpreter itself, unless Fluentd's own use of it is what makes the defect reachable
  • Third-party plugins published as separate gems outside the Fluentd tree

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.

While testing

  • Submit through sorona.xyz.
  • Report through the GitHub Security Advisory form on fluent/fluentd .
  • Give the configuration file that reproduces it and the plugin versions.
  • Say which artifact you tested

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2026-44160 High 7.5 8 Jul 2026
CVE-2026-44161 High 7.2 8 Jul 2026
CVE-2026-44024 Critical 9.8 8 Jul 2026
CVE-2026-44025 High 7.5 8 Jul 2026
CVE-2020-21514 High 8.8 4 Apr 2023
CVE-2022-39379 Low 3.1 2 Nov 2022
CVE-2021-41186 Medium 5.9 29 Oct 2021
CVE-2017-10906 Critical 9.8 8 Dec 2017

Original policy

Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months 6 Lifetime Remote code execution 35 % Auth bypass 25 % Info disclosure 25 % Denial of service 15 % Latest advisories Loading the feed Overview Fluentd is the CNCF logging layer that collects, parses and forwards logs from applications into whatever backend stores them. It runs as a daemon on hosts and as a sidecar or DaemonSet in Kubernetes, reading files and network inputs with the privileges needed to see everyone's logs. Its parser plugins process untrusted text from every application on the machine, and its output plugins hold credentials for the destinations. A parsing defect there is code execution on a process that already reads all the logs. Fluentd's SECURITY.md offers no reward. sorona.xyz pays you directly on qualified, reproduced findings. In scope Reports go through the GitHub Security Advisory form on fluent/fluentd , and the policy declares no boundary narrower than the Fluentd codebase itself The input plugins shipped in the tree, covering forward, http, tail, syslog, tcp, udp, exec, unix and monitor_agent The forward protocol itself, including its handshake, shared key authentication, username and password authentication, and TLS The parser plugins that run over untrusted log text: json, regexp, ltsv, csv, tsv, apache, apache2, nginx, syslog and multiline The filter plugins, in particular record_transformer and any filter that evaluates a Ruby expression over record content The output plugins and the credentials each holds for its destination, along with the retry and secondary output paths The buffer implementation, both memory and file, including what is written to disk, where and with which permissions The configuration parser: embedded Ruby evaluation, @include handling including remote includes over HTTP, and environment variable expansion Plugin loading, the plugin directory and gem installation as Fluentd performs it The RPC endpoint and the monitor_agent HTTP endpoint, and what each exposes to a caller The tail input's file handling, position file and log rotation logic The supervisor and worker process model, the signal handling between them and the socket manager Formatter plugins and the compression and chunking behaviour on the way out Out of scope Fluent Bit, a sibling project with its own repository and its own reporting address fluent-package, the Docker images and the Kubernetes DaemonSet images, which route to their own repositories Third-party plugins published as separate gems outside the Fluentd tree The Ruby interpreter itself, unless Fluentd's own use of it is what makes the defect reachable The destinations logs are forwarded to fluenthq.com, an unrelated product that shares part of the name Most-valued findings Code execution reached by parsing a log line, since the parser plugins are fed by every application on the host and the process reading them already sees all of it The forward input's authentication, the shared key handshake and its TLS handling, which is the only thing separating a legitimate aggregator from anything else that can reach the port Configuration parsing paths where embedded Ruby evaluation or a remote @include turns configuration into code, particularly where the config source is fetched over the network record_transformer and any filter evaluating an expression over attacker-influenced record content, which is log data reaching an interpreter The monitor_agent and RPC endpoints exposing configuration, plugin state or buffered records to an unauthenticated caller Buffer files written to a path or with permissions that let another user on the host read or replace queued log data before it is forwarded Regular expression handling in the parsers, where a crafted line drives catastrophic backtracking on a process that has to keep pace with log volume Credential disclosure from output plugin configuration through any endpoint, error message or emitted record Path handling in the tail input and its position file, where a symlink or a rotation race causes the daemon to read or write outside the intended directory Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the GitHub Security Advisory form on fluent/fluentd . That is the documented channel and there is no security mailing list to fall back to Nothing is paid at any severity. SECURITY.md carries no reward language of any kind fluenthq.com is an unrelated product that does pay for findings. It is not this project and filing there creates no path to a Fluentd fix Fluent Bit is a separate project in its own repository with its own security address. A finding in the C forwarder belongs there, not here fluent-package, the Docker images and the Kubernetes DaemonSet images route to their own repositories. Say which artifact you tested Give the configuration file that reproduces it and the plugin versions. Fluentd's behaviour is almost entirely a function of which plugins are loaded Disclosure Coordinated through the GitHub advisory flow with the Fluentd maintainers, published as a GitHub Security Advisory alongside a fixed gem release. Downstream packages and container images pick the fix up afterwards on their own schedules, so the embargo runs to the upstream advisory rather than to a day count you choose. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability