TensorFlow Serving

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 1 Lifetime Parsing/validation 35 % Code execution 25 % Access control 20 % Denial of service 15 % Latest advisories Loading the feed Overview TensorFlow Serving is the original production model server and still the reference implementation of the model-serving wire protocol that KServe, OpenVINO Model Server and NVIDIA Triton all implement compatibility for. In practice it runs as an unauthenticated internal service inside a very large number of enterprise ML platforms, listening on gRPC and REST and loading SavedModel bundles out of object storage. That is precisely the shape that produced the highest-value AI/ML bounties of the last two years: a network-reachable server whose day job is deserialising a model artefact, where the artefact is a protobuf graph definition that somebody else wrote. Google prices the repository at Tier OT1 on the Bug Hunters open-source VRP, $101 to $3,133.70 for a product vulnerability at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the public repositories of Google-owned GitHub organisations, and the tier file names tensorflow/serving at TIER_OT1. A product vulnerability anywhere in that repository is accepted, at $101 to $3,133.70 The network surface in full: the gRPC PredictionService with Predict, Classify, Regress and MultiInference, the model-status and metadata services, and the REST/HTTP API that fronts all of them SavedModel loading from local disk and from remote filesystems (GCS, S3, HDFS) through the TensorFlow filesystem plugins, together with the protobuf graph deserialisation underneath it The servable core: the model server config parser, version policies, the server core and the aspired-versions manager that decide which artefact loads and when one is retired The batching scheduler and its request coalescing, where several callers' requests are merged into a single batch The servable and source abstractions the repository exposes for custom loaders, which embedders extend to serve artefacts other than SavedModel The tensorflow_model_server binary itself, its command-line and config surface, and the container images released from this repository Repository configuration and the release pipeline behind those images and packages, which Google prices under its separate supply-chain category Out of scope TensorFlow core kernel bugs, which belong to the TensorFlow entry rather than to the model server Operator misconfiguration such as exposing the server to a network without authentication, which is documented behaviour rather than a defect Model-poisoning and adversarial-example research, which is ML robustness rather than a software vulnerability Denial of service produced by legitimate load, as opposed to a single malformed request that takes the server down Google repositories the tier file does not name, which sit at OT2 or OT3 and pay nothing for a product vulnerability Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, or an already merged patch Awards to researchers on a sanctions list, in a territory subject to sanctions, or located in Russia or Belarus, which Google states it cannot pay Most-valued findings A malformed SavedModel bundle that reaches code execution in the server while it loads: parsing and validation is 35% of the profile here, code execution another 25%, and this is the chain that reaches the top of the $3,133.70 band because the server's whole job is loading artefacts from storage it does not control A pre-authentication parse fault reachable straight from the gRPC or REST prediction endpoint, given how often this server sits unauthenticated on an internal network Path traversal or SSRF through the remote-filesystem plugins, where a model path pointing at GCS, S3 or HDFS makes the server fetch or write somewhere it should not Cross-tenant leakage in the batching scheduler, where coalescing lets one caller's inputs or outputs surface in another caller's response Config-parser and version-policy flaws that let an attacker who can write to the model directory get an unintended servable promoted into production Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repository is rated TIER_OT1 in Google's tier file, so product vulnerabilities cap at $3,133.70 rather than the $7,500 available to OT0 projects The $13,337 figure quoted for OT1 is the supply-chain-compromise category, covering Google source or build integrity rather than a code vulnerability in the repo Memory-corruption reports in OT0 and OT1 repositories need exact OSS-Fuzz reproduction steps or a patch already merged upstream A finding has to live in the model server itself: kernel bugs in TensorFlow core are assessed against the TensorFlow entry rather than this one The award is set by a discretionary panel, so the band is a range rather than a fixed table and a report that spells out real impact is what moves you up it Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with the fix landing in tensorflow/serving and shipping in the released server images. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail: operators pin server image versions and a pre-auth bug in a service that is usually deployed without authentication is immediately usable inside any network that has one. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability