kOps

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 2 asset) │ $5,000 │ $6,000 High │ $2,500 │ $3,125 Medium │ $500 │ $625 Low │ $100 │ $125 Submit a vulnerability CVE history 0 Last 12 months 1 Lifetime Access control 40 % Auth bypass 25 % Info disclosure 20 % Parsing/validation 10 % Latest advisories Loading the feed Overview kOps is the tool large organisations reach for when they run Kubernetes themselves rather than buying a managed control plane. It predates EKS and is still the default path for self-managed AWS fleets that need control over the API server flags, etcd topology and node images that EKS hides, and as a SIG Cluster Lifecycle project it is the reference implementation for production self-managed clusters. Its blast radius has an unusual shape: kOps does not sit in the data path, it creates the cluster, so a flaw here is a flaw in the trust anchor of every cluster it built. The one published CVE is exactly that, a privilege escalation reachable because of how kOps laid down node identity in GCE gossip mode. Adoption concentrates in finance, telco and large SaaS platforms, a smaller install base than Minikube's but a far higher-value one. The CNCF pays it on the Kubernetes program at HackerOne as a Tier 2 asset, $100 at Low rising to $5,000 at Critical, though the program-wide average award runs $100 to $200, and sorona.xyz adds 1.25× on top of whatever the CNCF awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 1 business day First response 10 business days Triage 10 business days Bounty In scope The kubernetes/kops repository, which the program lists as a bounty-eligible source-code asset up to critical severity under the instruction "Kubernetes Operations (kops) - Production Grade K8s Installation, Upgrades, and Management", priced at Tier 2: $100 at Low rising to $5,000 at Critical The cluster lifecycle commands and everything behind them: create, update, rolling-update and delete, along with the cluster spec API and the validation applied to it The state store, meaning the S3 or GCS bucket layout, the cluster spec kept there and the secrets and certificates alongside it, plus every path that reads or writes any of that Node bootstrap: nodeup , kops-controller and the bootstrap token and node-authorizer path that decides what a joining machine is allowed to claim to be What kOps generates for the cloud account, covering IAM policies, instance profiles and security groups, and what it lays down in the cluster, covering control plane flags, etcd topology and certificate material The in-cluster components kOps ships and manages, including protokube , dns-controller , channels and the addon manifests they apply The kOps CLI itself, including kubeconfig export and the credentials it writes on the operator's workstation Out of scope Vendor-specific cloud provider plugins, meaning the AWS, GCE, Azure, OpenStack and vSphere shims, which the scope table marks eligible_for_bounty: false Findings that require an insecure configuration, per "Attacks relying on insecure configurations (subject to the Security Response Committee's opinion)" Kubernetes running on Windows or other non-Linux operating systems Deprecated components, which are not supported targets Clusters built by releases outside the three most recent supported ones Reports from a maintainer, or from the author or reviewer of the vulnerable code, which the program cannot award Most-valued findings Privilege escalation through node identity or bootstrap, where a node or a pod on it gains more cluster authority than kOps intended, which is the CVE-2023-1943 shape and the class that carries the $5,000 Critical row An over-broad IAM policy or instance profile generated by default, letting a single compromised node reach the state store or other cloud resources Bootstrap token or node-authorizer flaws that let an unauthorised machine join a cluster as a legitimate node State store handling that lets a lower-privileged actor read or write the cluster spec, which is effectively control over every cluster built from it Credential or key material left readable in generated configuration, addon manifests or the state bucket Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Findings that live purely in an AWS, GCE or Azure provider shim are excluded as vendor-specific plugins and pushed to that cloud's own program A supply-chain finding that alters source code or release artifacts escalates to Tier 1 and USD 10,000 Only the three most recent releases are supported targets, so reproduce against a current version Attacks that require an insecure configuration are judged at the Security Response Committee's discretion The program-wide average award runs $100 to $200, so the $5,000 Critical row is a ceiling rather than an expectation Program stats 141 Reports resolved $112k Bounties paid 60% Response efficiency Disclosure Coordinated through the Kubernetes Security Response Committee, which negotiates a public disclosure date with the reporter and prefers full disclosure once user mitigation is available. For an installer, mitigation usually means a release plus a documented remediation path for clusters already built, so expect the window to run to a real fix; sorona.xyz holds your finding until the agreed date. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability