First-of-its-kind Cloud Hacking Competition
Join the world's top researchers in a competition to find zero-day vulnerabilities in core open-source software powering the cloud. Put your skills to the test, win huge prizes from our $5M prize pool, and help make the cloud a safer place.
Submit your exploit by
Sunday, December 1, 2025
In Partnership With:
How it works
Pick your targets
Research to find critical vulnerabilities in the open-source software that powers the cloud, and submit your entry by Dec 1
Demonstrate your exploit
Accepted submissions will be invited to demonstrate their exploit, live on stage, in London on Dec 10-11
Claim your prize
Successful exploit demonstrations will win generous payouts and be responsibly disclosed to relevant vendors
For more information check out our contest rules and FAQ
If you already use HackerOne, please ensure your ID verification, Tax Forms, and payment preferences are completed by November 20th.
If you are new to HackerOne and cannot complete ID verification yet, simply register on their platform, then submit your entry via our website, providing your HackerOne handle. We will then work with HackerOne to initiate the ID verification process for you.
Time & Place
100% FREE ACCESS
No paid Black Hat ticket required. Register for your complimentary Business Hall pass to attend.
ExCeL, London, UK | December 10-11, 2025
Targets & Payouts
Submitted exploits should result in total compromise of the target, meaning a 0-click unauthenticated Remote Code Execution (RCE) vulnerability, unless specified otherwise. For detailed setup information, see our official GitHub repository.
View Target Configurations on GitHub
Ollama
Runs consumer AI models in the cloud.
vLLM
Powers fast LLM endpoints in the cloud.
NVIDIA Container Toolkit
Enables GPU access for containerized cloud workloads.
Kubelet Server
Manages Pods on each Kubernetes Node.
K8s API Server
The central control plane for Kubernetes clusters.
Grafana
The unified observability dashboard for Kubernetes.
Fluent Bit
The lightweight standard for log aggregation across clusters.
Prometheus
The cloud-native standard for metrics and alerting.
Exploits in this section should result in a full Container/VM Escape. This will be tested by executing a predefined binary located on the host machine.
Docker
The industry standard for running containers.
Containerd
The core container runtime in Kubernetes.
Linux Kernel
The OS powering most cloud VMs.
Envoy
Manages microservice traffic in service mesh environments.
Caddy
Popular Go server for cloud apps.
Tomcat
Runs enterprise Java applications in the cloud.
Nginx
The industry standard for web serving, reverse proxying, and ingress.
Redis
Provides high-speed caching for cloud apps.
PostgreSQL
Provides high-speed caching for cloud apps.
MariaDB
Popular managed database engine.
Apache Airflow
Schedules cloud data workflows.
Jenkins
Automates cloud app deployments.
GitLab CE
Popular DevOps platform.
Participate for a chance to get invited to a closed research conference mid-2026
Stylish exploits are much appreciated - be creative and surprise us!
Frequently Asked Questions
