Minikube

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 2 asset) │ $5,000 │ $6,000 High │ $2,500 │ $3,125 Medium │ $500 │ $625 Low │ $100 │ $125 Submit a vulnerability CVE history 0 Last 12 months 3 Lifetime Access control 35 % Auth bypass 25 % Info disclosure 20 % Code execution 15 % Latest advisories Loading the feed Overview Minikube is the officially blessed local Kubernetes, the cluster that almost every Kubernetes tutorial, certification course and CNCF training module tells you to start with, and it runs on millions of developer laptops plus an enormous long tail of CI runners that spin it up as the ephemeral cluster under integration tests. Its security shape is inverted from server-side Kubernetes: the attacker is usually a malicious web page, a hostile container image or another process on the same machine, and the prize is the developer's workstation, their cloud credentials and their kubeconfig. All three of its published CVEs are exactly that, unintended local exposure, with the 2018 DNS-rebinding bug that let any website reach the Dashboard and take cluster-admin as the canonical case. The CNCF pays it on the Kubernetes program at HackerOne as a Tier 2 asset, $100 at Low rising to $5,000 at Critical, and sorona.xyz adds 1.25× on top of whatever the CNCF awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 1 business day First response 10 business days Triage 10 business days Bounty In scope The kubernetes/minikube repository, which the program lists as a bounty-eligible source-code asset up to critical severity under the instruction "Run Kubernetes locally", priced at Tier 2: $100 at Low rising to $5,000 at Critical The minikube binary and its whole command surface: start, stop, delete, tunnel, mount, service, dashboard, ssh, cp, image and addons The driver layer across Docker, Podman, KVM2, HyperKit, VirtualBox, QEMU and the rest, including how each one isolates the guest it creates from the host The ISO, the kicbase container image and the preload tarballs, along with the download and verification path that pulls Kubernetes binaries and images onto the workstation The addon system and the manifests it applies, including how Minikube stands up the Kubernetes Dashboard, registry, ingress and metrics-server Host-to-guest networking: port forwarding, minikube tunnel and minikube mount , which push cluster services onto the workstation's network and host directories into the cluster Certificate, credential and kubeconfig handling on the developer's workstation Out of scope Container escapes to the host "unless the attack path traverses a Kubernetes process (e.g. kubelet)", which the program states explicitly Non-Linux Kubernetes targets, which trims part of the macOS and Windows driver surface Non-Kubernetes binaries distributed as cluster addons, which belong to their own upstream projects Deprecated drivers and deprecated components, which are not supported targets Releases older than the three most recent, which fall outside the supported window Reports from maintainers, or from the author or reviewer of the vulnerable code, which cannot be awarded Most-valued findings A malicious web page or a process on the same machine reaching a Minikube-exposed cluster endpoint and obtaining cluster-admin, the DNS-rebinding shape of CVE-2018-1002103 and the class that carries the $5,000 Critical row Authentication bypass on a component Minikube stands up by default, such as the default-password SSH path that produced CVE-2023-1944 Unintended exposure of a cluster port to the workstation's network or to other local users, the failure behind CVE-2023-1174 on the macOS Docker driver Theft or leakage of the developer's kubeconfig, cloud credentials or registry secrets off the host Code execution inside the VM that traverses a Kubernetes process such as the kubelet and lands on the host, which is the one escape shape the program pays for Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Minikube sits at Tier 2, so the reachable ladder runs $100 to $5,000 rather than the program's Tier 1 maximum A supply-chain finding that alters source code or release artifacts escalates to Tier 1 and USD 10,000 Maintainers and the authors or reviewers of the vulnerable code are ineligible for the award Only the three most recent releases are supported targets, so reproduce against a current version The public disclosure date is negotiated with the Kubernetes Security Response Committee rather than set by you Program stats 141 Reports resolved $112k Bounties paid 60% Response efficiency Disclosure Coordinated through the Kubernetes Security Response Committee, which negotiates a public disclosure date with the reporter and states a preference for full disclosure as soon as user mitigation is available. That makes the window bounded rather than open-ended, and sorona.xyz holds your finding until the agreed date. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability