First-of-its-kind Cloud Hacking Competition
Join the world's top researchers in a competition to find zero-day vulnerabilities in core open-source software powering the cloud. Put your skills to the test, win huge prizes from our $4.5M prize pool, and help make the cloud a safer place.
Submit your exploit by
Sunday, December 1, 2025
In Partnership With:
How it works
Pick your targets
Research to find critical vulnerabilities in the open-source software that powers the cloud, and submit your entry by Dec 1
Demonstrate your exploit
Accepted submissions will be invited to demonstrate their exploit, live on stage, in London on Dec 10-11
Claim your prize
Successful exploit demonstrations will win generous payouts and be responsibly disclosed to relevant vendors
For more information check out our contest rules and FAQ
To be eligible to participate all team members must register to the HackerOne platform and complete the ID verification, Tax Forms, and payment preferences by November 20
Time & Place
ExCeL, London, UK | December 10-11, 2025
Targets & Payouts
Submitted exploits should result in total compromise of the target, meaning a 0-click unauthenticated Remote Code Execution (RCE) vulnerability, unless specified otherwise.
Ollama
Runs consumer AI models in the cloud.
vLLM
Powers fast LLM endpoints in the cloud.
NVIDIA Container Toolkit
Enables GPU access for containerized cloud workloads.
Kubelet Server
Manages Pods on each Kubernetes Node.
K8s API Server
The central control plane for Kubernetes clusters.
Grafana
The unified observability dashboard for Kubernetes.
Fluent Bit
The lightweight standard for log aggregation across clusters.
Prometheus
The cloud-native standard for metrics and alerting.
Exploits in this section should result in a full Container/VM Escape. This will be tested by executing a predefined binary located on the host machine.
Docker
The industry standard for running containers.
Containerd
The core container runtime in Kubernetes.
Linux Kernel
The OS powering most cloud VMs.
Envoy
Manages microservice traffic in service mesh environments.
Caddy
Popular Go server for cloud apps.
Tomcat
Runs enterprise Java applications in the cloud.
Nginx
The industry standard for web serving, reverse proxying, and ingress.
Redis
Provides high-speed caching for cloud apps.
PostgreSQL
Provides high-speed caching for cloud apps.
MariaDB
Popular managed database engine.
Apache Airflow
Schedules cloud data workflows.
Jenkins
Automates cloud app deployments.
GitLab CE
Popular DevOps platform.
Participate for a chance to get invited to a closed research conference mid-2026
Stylish exploits are much appreciated - be creative and surprise us!
Frequently Asked Questions
