Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
4
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by program:orbitstack ×
  • highPGN-10301· undisclosed

    Edge pool admission webhook can be bypassed with a legacy API version

    Awaiting triage.

    Orbitstack@ovisImproper Authorization09 Nov 2026
    —
    New
  • criticalPGN-10479

    Cross-tenant secret read via node-local metadata proxy in shared edge pool

    Pods on the edge pool could reach a node-local proxy that did not scope credentials by namespace. The proof read a secret from a second researcher-owned tenant only.

    Orbitstack@ovisImproper Isolation or Compartmentalization27 Oct 2026triage 5.8hresolved 4.6d
    $85,000
    Resolved
  • lowPGN-10392

    Control-plane gRPC gateway reflects internal service address in error on malformed metadata

    Paid at Low because the address was reachable from the gateway in a follow-up probe; otherwise it would have been informative.

    Orbitstack@vesper.shExposure of Sensitive Information30 Sept 2026triage 6.5hresolved 2.6d
    $1,200
    Resolved
  • lowPGN-10342

    Informative: version banner on docs origin

    Closed as informative within three hours; no crossing of a trust boundary was shown.

    Orbitstack@tangentExposure of Sensitive Information14 Sept 2026triage 3h
    —
    Informative
Hacktivity
Connecting
  • newOrbitstack@ovis
    Edge pool admission webhook can be bypassed with a legacy API version
    high
    3d ago
  • Bounty paidOrbitstack@ovis
    Cross-tenant secret read via node-local metadata proxy in shared edge pool
    critical
    $85k
  • Bounty paidOrbitstack@vesper.sh
    Control-plane gRPC gateway reflects internal service address in error on malformed metadata
    low
    $1,200
  • informativeOrbitstack@tangent
    Informative: version banner on docs origin
    low
    14 Sept 2026
All disclosed reports →