OpenVINO Model Server

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, CVSS 9.0-10.0 (Intel Software tier; the $100,000 headline is the Hardware tier) │ Up to $10,000 │ Up to $11,000 High and Medium, CVSS 4.0-8.9 (Intel publishes the Software tier as a whole, not a per-band figure) │ $500 - $10,000 │ $625 - $11,000 Low, CVSS 0.1-3.9 │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 3 Lifetime Access control 30 % Parsing/validation 30 % Code execution 25 % Info disclosure 10 % Latest advisories Loading the feed Overview OpenVINO Model Server is the production serving tier for OpenVINO models, and because it speaks both the TensorFlow Serving and KServe v2 wire protocols it drops straight into existing Kubernetes inference stacks: it ships as a supported container in Intel's edge ecosystem and in Red Hat OpenShift AI. Its blast radius is the one that matters: a network-facing, unauthenticated-by-default inference endpoint that loads model artefacts out of object storage, which is precisely the shape of the Ray and Triton incidents of the last two years. Only three CVEs have ever been filed against it, all of them denial of service, which says more about attention than about safety. Intel pays for it on Intigriti under the Software tier, where a critical finding reaches up to $10,000 and the floor is $500, and sorona.xyz adds 1.25× on top of whatever Intel awards, up to $1,000 more, plus a complexity bonus of up to $1,000. In scope Intel accepts security issues in open-source projects it solely maintains, and openvinotoolkit is Intel's organisation, so the whole model_server repository is the target. Recorded honestly: OVMS publishes no SECURITY.md, so eligibility rests on org ownership alone. Software is Tier 3 at $500 to $10,000. The network surface in full: the gRPC and REST inference endpoints implementing the TensorFlow Serving and KServe v2 APIs, the OpenAI-compatible chat, completions and embeddings endpoints, the metrics and status endpoints, and the transport-security options the server puts in front of them Model repository loading from local disk, S3, GCS and Azure Blob, and the credential handling each of those backends requires The configuration layer: the config JSON parser, model version policies and the runtime config-reload path The DAG scheduler, MediaPipe graph execution, and the custom node and custom loader interfaces used to build multi-model pipelines The published Docker images: entrypoint, privilege model and the packaging the project ships to production The in-process C API and the client libraries the repository publishes for calling the server from other code Out of scope Bugs in the OpenVINO Runtime itself, which are a separate report against a separate repository, since one root cause equals one bounty Operator misconfiguration, such as exposing the inference endpoint to the internet without a proxy in front of it Denial of service achieved through legitimate high load rather than through a defect Third-party base-image CVEs that cannot be root-caused to OVMS code Pre-release and beta builds, which Intel puts out of scope for bounty rewards Anything in Intel's *.intel.com web infrastructure, which has its own reporting address Intel's live out-of-scope table on Intigriti lists Intel-maintained open-source projects as out of scope and sends reporters to the project maintainer, which contradicts the scope section admitting projects Intel solely maintains. Confirm eligibility with Intel before committing time. Most-valued findings Unauthenticated remote code execution on the serving container reached through the gRPC or REST endpoint: the finding that carries the top of the ladder, and the reason access control and code execution together dominate the bug classes here Model-repository path or config-JSON handling that lets a request load an artefact the operator never published, including traversal into the host filesystem or into another tenant's bucket prefix Cross-model or cross-tenant data exposure through the DAG scheduler, where one pipeline reads state belonging to another Request-parsing memory corruption in the KServe v2 or TensorFlow Serving protocol handlers Container privilege issues that turn a contained inference bug into host access Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Send the report to Intel first and discuss it with nobody Intel has not authorised, video proof-of-concept included The finding must be original, unreported and not already public, and must be demonstrated on a currently supported public release: archived and end-of-life repositories pay nothing One CVE equals one bounty: if the root cause is in the OpenVINO Runtime rather than in the server, it is one report against the runtime, not two You need an Intigriti account, must be 18 or over, must have your employer's approval where it is required, and must clear sanctions screening before Intel can pay This repo publishes no SECURITY.md, so eligibility rests on Intel's ownership of the openvinotoolkit organisation: say so explicitly in the report, because Intel's matrix rates open-source software only a "Maybe" for bounty Disclosure Coordinated by Intel PSIRT through the Intel Security Center; the repository itself offers no disclosure policy of its own. Intel controls timing and its non-disclosure clause runs until Intel gives written consent, so sorona.xyz holds the finding until Intel has published. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability