Tiered Storage for Apache Kafka

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz P1: Critical (Aiven Open Source Repositories target group) │ $1,000 - $1,500 │ $1,250 - $1,875 P2: High │ $500 - $1,000 │ $625 - $1,250 P3: Medium │ $250 - $500 │ $313 - $625 P4: Low │ $50 - $250 │ $63 - $313 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Info disclosure 35 % Access control 25 % Parsing/validation 20 % Code execution 15 % Latest advisories Loading the feed Overview This is the most widely used open-source implementation of Kafka's KIP-405 remote-storage plugin interface: the component that takes historical log segments off broker disks and pushes them into S3, Google Cloud Storage or Azure Blob, then chunks, encrypts, indexes and fetches them back on demand. Its footprint is concentrated but consequential: it runs inside Kafka brokers at organisations large enough to need multi-terabyte retention, in Aiven's managed fleet and in self-hosted estates alike, and its 236 stars badly understate an operator-side rather than developer-side user base. It is also the component holding the AES data keys and the object-store credentials for that archived data, which is why info disclosure dominates the expected bug distribution here: a key-handling or chunk-indexing flaw exposes an organisation's entire retained event history rather than a single request. Aiven Ltd pays for reports through its Bugcrowd managed program, under the Aiven Open Source Repositories target group: P1 pays $1,000 to $1,500, down to $50 at P4. sorona.xyz adds 1.25× on top of whatever Aiven awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope What the program declares: vulnerabilities in Aiven open source code, with github.com/Aiven-Open listed as a target. This plugin sits inside that organisation, so the repository is covered in full at P1 $1,000 to $1,500 under the Aiven Open Source Repositories group. The RemoteStorageManager implementation as a whole: the upload, fetch and delete of log segments and their indexes, and the manifests the plugin writes alongside them Segment chunking, indexing and reassembly on fetch, where a remote segment is turned back into the bytes a consumer receives The local and remote chunk caches, including cache-key handling and eviction Client-side AES encryption: data-key generation, the key-wrapping scheme, and everything that decides which key decrypts which segment The object-storage backend clients for AWS S3, Google Cloud Storage and Azure Blob, and the credential handling inside each of them Compression and decompression of offloaded segments, and the serialisation and deserialisation of remote segment metadata the broker reads back out of object storage The plugin's configuration surface, which is how an operator sets the bucket, the credentials and the key material it runs with Out of scope Anything other than the most recent release, which is the only version the program will grade Issues in the upstream Apache Kafka broker itself, which belong to the ASF, and the ASF pays nothing for them Bugs inherited from a forked upstream project rather than introduced by this plugin Application-level denial of service, excluded by the program's baseline for all targets Cloud-provider infrastructure issues in S3, GCS or Azure Blob rather than in this plugin's use of them Theoretical findings with no proof of concept Dependency-only CVE reports without a demonstrated chain through this code Most-valued findings Anything that discloses retained segment data across a boundary: a chunk-cache key collision, an index confusion, or a fetch path that returns another topic's or another tenant's bytes. That is the largest class here at 35% and the finding with the broadest blast radius. A defect in the AES key-wrapping or data-key handling that lets archived segments be decrypted without the key material the design assumes, since that turns an object-storage read into a full history read Exposure of the object-store credentials the plugin holds, through logs, metrics, error paths or metadata, which hands over every segment the cluster ever offloaded Deserialization of remote segment metadata leading to code execution inside the broker process, the one path here that runs attacker-influenced structure through a JVM deserializer Parsing or decompression flaws on the fetch path that a party who can write to the object store, or influence what gets written, can turn into broker-side memory corruption or unbounded expansion Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only the most recent release counts: findings against older versions are not eligible Bugs in the upstream Apache Kafka broker itself belong to the ASF, which pays nothing for them; only the plugin's own code is bountiable here The forked-code exclusion applies: anything inherited from an upstream project has to go upstream instead Application-level denial of service is out of scope for every target on this program Bring a proof of concept, and demonstrate a chain rather than reporting a dependency CVE on its own The program acknowledged a volume-related reward backlog on 21 July 2026, so expect payment to lag validation Disclosure Coordinated through Bugcrowd, under the Aiven Open Source Repositories target group. Because Aiven will not accept an issue that reached it through any other channel first, file with Aiven through Bugcrowd directly and hold the detail until a fixed release is out: this plugin ships inside broker deployments that operators upgrade on their own schedule. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability