Originally reported by ZDNet. Published January 2020.
CNCF Opens Kubernetes Bug Bounty to All Security Researchers
The Cloud Native Computing Foundation (CNCF) has officially launched a public bug bounty program for Kubernetes, the widely adopted container orchestration platform. After several months in private beta and nearly two years since the initial proposal, the program is now open to the broader security research community.
The program is administered by the Kubernetes Product Security Committee and operated through HackerOne, a security platform that specialises in coordinating vulnerability disclosure and bug bounty programs.
Why a Bug Bounty Program for Kubernetes?
Kubernetes has become one of the most widely deployed infrastructure technologies in modern software operations. Its rapid adoption, combined with quarterly major releases and the pressure organisations face to deploy quickly, creates meaningful security risk at scale. The bug bounty program is designed to complement the existing Kubernetes security audit and the work of the Product Security Committee by incentivising external researchers to scrutinise the codebase.
Kubernetes already has a robust security team and response process, further cemented by the recent Kubernetes security audit. We have a stronger and more secure open-source project than we’ve ever had before. By launching a bug bounty program, we’re putting our money where our mouth is – and most importantly, rewarding the researchers already doing this important work. We hope to attract additional security researchers to get more eyes on the code, shake out security bugs, and back up our work on Kubernetes security with financial support.
Maya Kaczorowski, Product Manager for Container Security, Google Cloud
How the Program Is Operated
HackerOne manages the program on behalf of the CNCF. To ensure submissions are evaluated accurately, HackerOne staff involved in triaging reports are Certified Kubernetes Administrators (CKA). This matters because the bug bounty covers all Kubernetes code across more than 100 certified distributions — a significant and technically demanding scope.
What Is In Scope
The bug bounty focuses on vulnerabilities that could compromise Kubernetes clusters or the integrity of the project itself. In-scope targets include:
- Core Kubernetes source code hosted on GitHub
- Continuous integration (CI) pipelines, release processes, and documentation artifacts
- Privilege escalation vulnerabilities
- Authentication bypass bugs
- Remote code execution in the kubelet or Kubernetes API server
- Workload information leaks or unexpected permission changes
- Supply chain security, including the build and release pipeline
What Is Out of Scope
The program has clearly defined boundaries to keep submissions relevant and actionable:
- Community management tooling such as Kubernetes mailing lists or Slack channels
- Container escape vulnerabilities — these affect the container runtime, not Kubernetes itself
- Linux kernel vulnerabilities
- Third-party dependencies such as etcd — these should be reported directly to their respective security teams
Researchers who discover Kubernetes-related vulnerabilities that fall outside the bounty scope are still encouraged to disclose them privately to the Kubernetes Product Security Committee, rather than leaving them unreported.
Reward Structure
Payouts are tiered based on the severity of the vulnerability discovered:
| Severity | Reward |
|---|---|
| Low priority | $200 |
| Critical vulnerability | Up to $10,000 |
The full reward tiers for intermediate severity levels (medium, high) were not detailed in the original announcement summary. Researchers should consult the official HackerOne program page for the complete payout schedule.
What This Means for the Kubernetes Security Ecosystem
This program represents a significant step in the maturation of Kubernetes security practices. Combined with the formal security audit conducted prior to the launch, and the ongoing work of the Product Security Committee, the bug bounty programme adds a crowd-sourced layer of scrutiny that complements internal processes. For DevOps and platform engineering teams running Kubernetes in production, a more actively reviewed codebase translates directly to a reduced attack surface over time.
Security researchers with Kubernetes expertise are encouraged to review the program scope and submission guidelines on the official HackerOne platform before submitting reports.