Browse / Cloudflare Public Bug Bounty

Cloudflare Public Bug Bounty

See its reports on the map

Attack surface: 24,294 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Cloudflare Public Bug Bounty

• Access Control11
• Authentication8
• Cross-site Scripting6
• Information Disclosure4
• Injection and Smuggling3
• Other weaknesses3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() functionHTTP Request Smuggling · critical
   $6,000116 votes
2. Cloudflare CASB Confused Deputy Problemcritical
   $3,30097 votes
3. Using special IPv4-mapped IPv6 addresses to bypass local IP banImproper Access Control - Generic · critical
   $7,50078 votes
4. Bypass of Cloudflare's Cache Keys and WAF via header overflowImproper Access Control - Generic · high
   77 votes
5. Hijack all emails sent to any domain that uses Cloudflare Email ForwardingImproper Authorization · critical
   $6,00076 votes
6. `use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using itCross-site Scripting (XSS) - Generic · medium
   $55075 votes
7. Yet Another CASB Integration Takeover of Active Integrationshigh
   68 votes
8. [Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuthCross-site Scripting (XSS) - Stored · high
   63 votes
9. AI Playground XSS to steal user-chat messages and access to connected MCP ServerCross-site Scripting (XSS) - Reflected · low
   62 votes
10. Bypass R2 payment screenImproper Restriction of Authentication Attempts · medium
    $35057 votes
11. HTTP Request Smuggling via Unsanitized Hop-by-Hop HeadersImproper Access Control - Generic · high
    $1,50054 votes
12. Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfigurationServer-Side Request Forgery (SSRF) · low
    54 votes
13. Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATOCross-site Scripting (XSS) - Stored · low
    50 votes
14. Any WARP User Can Access Organization-Specific ApplicationInformativeImproper Authentication - Generic
    46 votes
15. HTTP request smuggling with Origin Rules using newlines in the host_header action parameterHTTP Request Smuggling · critical
    $3,10046 votes
16. Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seatImproper Authentication - Generic · high
    43 votes
17. Enable 2Fa verification without verifying emailImproper Access Control - Generic · medium
    40 votes
18. Arbitrary file read from Cloudflare Pages build environmentPath Traversal · medium
    40 votes
19. Signup with any Email and Enable 2-FA without verifying EmailImproper Authentication - Generic · medium
    40 votes
20. [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp AuthCross-site Scripting (XSS) - Generic · high
    39 votes
21. Bypassing Cache Deception Armor using .avif extension fileInformation Disclosure · medium
    36 votes
22. Bypass two-factor authenticationImproper Authentication - Generic · low
    $25034 votes
23. A malicious actor could rotate tokens of a victim, given that he knows the victim's token IDImproper Access Control - Generic · high
    34 votes
24. Sign in with Apple works on existing accounts, bypasses 2FAImproper Authentication - Generic · high
    $1,00032 votes
25. 💥💥Crash report -Cloudflare WARP doesn't verify text length in "Excluded Host" name input data💥💥Memory Corruption - Generic · low
    29 votes
26. Take over subdomains of r2.dev using R2 custom domainsmedium
    $1,12528 votes
27. API docs expose an active token for the sample domain theburritobot.comInformation Disclosure · high
    $50028 votes
28. Basic XSS [WAF Bypasses]InformativeCross-site Scripting (XSS) - Generic
    $5027 votes
29. YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.comInformativeResource Injection · low
    24 votes
30. Cloudflare is not properly deleting user's accountBusiness Logic Errors · medium
    23 votes
31. cd=false (DNSSEC) not respected in DNS over HTTPS JSON requestsBusiness Logic Errors · low
    $25023 votes
32. Origin IP address disclosure through Pingora response headerInformation Exposure Through an Error Message · medium
    21 votes
33. Completely remove VPN profile from locked WARP iOS cient.Client-Side Enforcement of Server-Side Security · high
    $1,00021 votes
34. I found another way to bypass Cloudflare Warp lock!Client-Side Enforcement of Server-Side Security · high
    $1,00020 votes
35. Bypassing creation of API tokens without email verificationImproper Authentication - Generic · low
    19 votes
36. Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accountsImproper Authentication - Generic · low
    $25017 votes
37. Session mismatch leading to potential account takeover (local access required)Insecure Direct Object Reference (IDOR) · medium
    16 votes
38. Extraction of Pages build scripts, config values, tokens, etc. via symlinksInformation Disclosure · medium
    $50012 votes
39. Ability to bypass locked Cloudflare WARP on wifi networks.Client-Side Enforcement of Server-Side Security · high
    $1,00012 votes
40. Misconfigured build on websites "abuse.cloudflare.com"Misconfiguration · low
    $10012 votes
41. Password Policy Restriction BypassViolation of Secure Design Principles · low
    11 votes
42. Privilege escalation to root in Pages build image v2Privilege Escalation · low
    $35010 votes
43. Bypass Cloudflare WARP lock on iOS.Client-Side Enforcement of Server-Side Security · medium
    $50010 votes
44. Lack of Packet Sanitation in Goflow Results in Multiple DoS Attack Vectors and BugsUncontrolled Resource Consumption · high
    $5008 votes