TiKV

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, Core Business (TiKV is a core TiDB component) │ $2,500 - $5,000 │ $3,125 - $6,000 High Risk, Core Business │ $1,000 - $2,500 │ $1,250 - $3,125 Medium Risk, Core Business │ $250 - $1,000 │ $313 - $1,250 Low Risk, Core Business │ $100 │ $125 Submit a vulnerability CVE history 0 Last 12 months 2 Lifetime Denial of service 35 % Access control 25 % Memory safety 20 % Info disclosure 15 % Latest advisories Loading the feed Overview TiKV is the distributed transactional key-value engine underneath TiDB, and a CNCF Graduated project in the same tier as Kubernetes, Prometheus and etcd. Its production footprint is heaviest in Asia, where TiDB is the system of record rather than a cache for banking, payments, ride-hailing and large e-commerce workloads at Meituan, Xiaomi, JD.com, Pinterest, Shopee, Flipkart and Zhihu, and it is also run standalone as a backing store for other infrastructure. What makes it interesting is that it is a large, complex, financially critical Rust codebase with exactly two published CVEs in its entire life, both remote denial of service reachable by anyone who can speak to the service. That is the security shape of a Rust database engine: memory-safety bugs are rarer than in a C++ equivalent, but the unsafe blocks around the RocksDB FFI and the Coprocessor's expression evaluation are real, and denial of service is elevated because one malformed gRPC message that panics a node degrades a shard of the cluster. PingCAP pays for it directly rather than through any platform, and the operational detail that matters most is that TiKV's own SECURITY.md sends reports to [email protected] , an unpaid CNCF list the money never touches: the cash pathway is [email protected] under a vendor policy the repository never mentions. TiKV is classified Core Business, so the applicable row is $2,500 to $5,000 for a Critical. sorona.xyz adds 1.25× on top of whatever PingCAP awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope PingCAP's guidelines apply to "PingCAP's core open-source products and publicly available internet applications, including but not limited to" its SaaS domains "as well as components directly related to the TiDB product, such as TiKV, TiDB, TiFlash, PD, etc.", so github.com/tikv/tikv is in scope by name and on the Core Business rows The distributed transactional key-value engine, the raftstore and its Raft consensus implementation, and region split, merge and scheduling The RocksDB-backed storage engine, including the unsafe code around the FFI boundary The gRPC service surface defined by kvproto, which carries the raw KV API, the transactional KV API and every message a client, a peer or the PD scheduler sends Transaction handling: the Percolator-style two-phase commit, lock resolution, and MVCC garbage collection The Coprocessor, which executes pushed-down query fragments inside the storage node rather than in the SQL layer above it The status and metrics HTTP server, the debug endpoints behind it, and the configuration reload path Backup, restore and SST import paths, which take files from outside the cluster and load them into a region TLS and mTLS between TiKV, PD and TiDB nodes, which is the only thing separating a cluster peer from anyone else on the network Out of scope Components with no direct relationship to the TiDB product, since the guidelines anchor on PingCAP's core open-source products and the components directly related to TiDB General Business assets, meaning sites and components outside the core products, which price on the lower half of the same table rather than on TiKV's Core Business rows Duplicate reports, where PingCAP explicitly reserves the right to decide whether any reward is issued Anything PingCAP judges to fail its validity criteria or its reward conditions, which is discretionary by the terms of the guidelines themselves Reports sent only to [email protected] , the address the repository's own SECURITY.md gives, because that is an unpaid CNCF list and the money is on [email protected] Most-valued findings Remote, unauthenticated compromise reached over the gRPC service surface. Every client and scheduler message enters there, and it is the only realistic route to a Critical grading on the Core Business row. Memory-safety defects in the unsafe code around the RocksDB FFI and in Coprocessor expression evaluation, the two places a Rust database engine still carries C-shaped bugs Transactional correctness failures in the Percolator two-phase commit, in lock resolution, or in MVCC garbage collection, where committed data can be lost, resurrected, or read across a boundary it should not cross Remote denial of service that panics a node from a single malformed message: 35% of this project's bug mix and precisely what both published CVEs are, because a downed node degrades a shard of a cluster that is somebody's system of record TLS or mTLS bypass between TiKV, PD and TiDB, which turns network reachability into the ability to speak as a trusted cluster peer Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Email [email protected] to be paid: TiKV's own SECURITY.md routes to [email protected] , an unpaid CNCF list, so following the repository's stated process in good faith earns nothing Include a title, a description of the harm, the affected components and versions, reproduction steps, your contact details and a fix recommendation; PingCAP's guidelines ask for all of them Severity and business-type classification are PingCAP's to make, and the Core-versus-General split is a fourfold swing at the top of the ladder Rewards are discretionary: PingCAP reserves the right to decide whether to issue one at all on duplicates, reports failing its validity criteria, and reports failing its reward conditions, and it holds the final interpretation right Nothing goes to a third party before TiDB releases a patch, and the separate bar on disclosing exploit code carries no time bound at all Disclosure Coordinated with PingCAP by email to [email protected] , on PingCAP's schedule: the disclosure date is agreed after assessment rather than fixed in advance. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability