Klaw

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz P1: Critical (Aiven Open Source Repositories target group) │ $1,000 - $1,500 │ $1,250 - $1,875 P2: High │ $500 - $1,000 │ $625 - $1,250 P3: Medium │ $250 - $500 │ $313 - $625 P4: Low │ $50 - $250 │ $63 - $313 Submit a vulnerability CVE history 3 Last 12 months 3 Lifetime Access control 40 % Auth bypass 25 % Injection 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Klaw is Aiven's Apache-2.0 governance portal for Apache Kafka: a Java and Spring application through which teams request topics, ACLs, schemas and connectors, and through which approvers grant or refuse them. Its footprint is narrower than Karapace's and its position is far more sensitive, because the instances that exist are run by enterprises that need auditable multi-team Kafka governance, which means they hold privileged credentials for production Kafka clusters and act as the gate deciding who may read which topic. An authorization bypass in Klaw is not a bug in a portal; it is a bypass of the control that decides who can consume a company's event streams, which is why access control and auth bypass together account for roughly two thirds of the expected bug distribution here. Aiven Ltd pays for reports through its Bugcrowd managed program, under the Aiven Open Source Repositories target group: P1 pays $1,000 to $1,500, down to $50 at P4, with the higher tiers on the same page reserved for Aiven's managed services. sorona.xyz adds 1.25× on top of whatever Aiven awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope What the program declares: vulnerabilities in Aiven open source code, with github.com/Aiven-Open listed as a target. Klaw sits at github.com/Aiven-Open/klaw, so the whole application is covered at P1 $1,000 to $1,500, and its SECURITY.md adds that any reproducible vulnerability with a severe effect on user security or privacy is likely to qualify. The authentication, session and role model, which in a governance tool is the product itself The topic, ACL, schema and connector request and approval workflows, including anything that lets a request take effect without the approval it required The cluster-api component, which talks to Kafka and to the Schema Registry on the user's behalf and therefore acts with more authority than the user has Credential storage and handling for the managed Kafka clusters Klaw is configured against The Java and Spring backend REST API in full, including endpoints reachable without the browser UI in front of them, and the UI itself The published container images as distributed Out of scope Anything other than the most recent release, which is the only version the program will grade Findings inherited from an upstream project that Klaw forked, which belong upstream rather than here Application-level denial of service, brute force and text injection, all named out of scope Missing HTTP security headers, TLS configuration choices, and email SPF, DKIM or DMARC best-practice reports Clickjacking on pages that carry no sensitive action Version-banner disclosure and verbose error messages Theoretical issues with no proof of concept Most-valued findings Authorization bypass that lets one team read, request or approve against another team's topics, ACLs or connectors. It is the dominant class here at 40% and the finding that reaches P1, because it defeats the exact control Klaw exists to enforce. Approval-workflow bypass where a topic, ACL or connector request takes effect without a valid approver, or where a requester can approve their own request Authentication bypass on the Spring REST API, including endpoints that enforce authorization in the UI layer but not on the server Extraction of the stored Kafka cluster credentials Klaw holds, which converts a portal compromise into direct access to production event streams Injection reaching the cluster-api component, where user-supplied topic, ACL or connector configuration crosses into a privileged call against Kafka or the Schema Registry Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only the most recent release counts: findings against older versions are not eligible The forked-code exclusion applies: anything inherited from an upstream project Klaw forked has to go upstream instead Application-level denial of service, brute force and text injection are all out of scope Submission must have a human in the loop; automated reporting is barred Bring a proof of concept: theoretical authorization arguments without a working demonstration are closed The program acknowledged a volume-related reward backlog on 21 July 2026, so expect payment to lag validation Disclosure Coordinated through Bugcrowd; Klaw's own SECURITY.md routes reporters to the same program and says any reproducible vulnerability with a severe effect on user security or privacy is likely in scope. Because Aiven will not accept an issue that reached it through any other channel first, file with Aiven through Bugcrowd directly and hold the detail until a fixed release ships. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability