LiteLLM
The universal gateway for managing cloud-based LLMs.
$40,000
Unauthenticated RCE (pre-auth)
- The Cloud Hacking Competition -
Join the world's top researchers in a competition to find zero-day vulnerabilities in core open-source software powering the cloud. Put your skills to the test, win huge prizes from our $6.5M prize pool, and help make the cloud a safer place.
Submit your exploit by Tuesday, 1 December 2026 at 17:00 GMT
Research to find critical vulnerabilities in the open-source software that powers the cloud, and submit your entry by Dec 1
Accepted submissions will be invited to demonstrate their exploit, live on stage, in London on Dec 9-10
Successful exploits will win generous payouts and be responsibly disclosed to relevant vendors
Submitted exploits should result in total compromise of the target, meaning a 0-click unauthenticated Remote Code Execution (RCE) vulnerability, unless specified otherwise. For detailed setup information, see our official GitHub repository.
The universal gateway for managing cloud-based LLMs.
$40,000
Unauthenticated RCE (pre-auth)
Powers fast LLM endpoints in the cloud.
$40,000
Enables GPU access for containerized cloud workloads.
Sponsored by NVIDIA
$40,000
Container escape
Exploits in this section should result in a full Container/VM Escape. This will be tested by executing a predefined binary located on the host machine.
The industry standard for running containers.
$30,000
Container escape: user-supplied image
$50,000
Container escape: arbitrary image (no kernel exploit)
The industry standard for running containers.
$30,000
Container escape: user-supplied image
$50,000
Container escape: arbitrary image (no kernel exploit)
The Linux kernel underlying Ubuntu cloud workloads.
$20,000
Application kernel for secure container isolation in cloud environments.
$200,000
Secure microVM powering isolated cloud-native workloads.
$200,000
Database targets are pre-auth only: remote code execution without credentials against services with authentication enabled.
Provides high-speed caching for cloud apps.
$100,000
Unauthenticated RCE (pre-auth)
Open-source relational database powering cloud applications.
$100,000
Unauthenticated RCE (pre-auth)
Popular managed database engine.
$100,000
Unauthenticated RCE (pre-auth)
The lightweight standard for log aggregation across clusters.
$20,000
The unified observability dashboard for Kubernetes.
$10,000
Authenticated RCE
$40,000
Unauthenticated RCE (pre-auth)
Manages Pods on each Kubernetes Node.
$40,000
The cloud-native standard for metrics and alerting.
$40,000
The central control plane for Kubernetes clusters.
$80,000
The leading Content Management System for scalable web publishing.
$80,000
Component-based library for building dynamic user interfaces.
$80,000
React framework for production-grade, server-rendered cloud applications.
$80,000
High-performance Python framework for building asynchronous cloud APIs.
$40,000
Enterprise-grade Java framework for deploying robust cloud microservices.
$40,000
The industry standard for web serving, reverse proxying, and ingress.
$300,000
The industry standard HTTP server for foundational cloud infrastructure.
$150,000
Runs enterprise Java applications in the cloud.
$75,000
Manages microservice traffic in service mesh environments.
$50,000
Orchestrates and schedules data workflows in the cloud.
$40,000
Unauthenticated RCE (pre-auth)
Anyone over the age of majority in their country/state of residence can participate. Teams of 2–5 members or individual participants may enter. Employees of Wiz, its affiliates, government officials and public sector employees, and partner companies (AWS, Google, Microsoft) cannot participate. Participants cannot be residents of embargoed or sanctioned countries (e.g., Russia, China, Iran, North Korea, Cuba, Sudan, Syria, Libya, Lebanon, or restricted regions like Crimea, Donetsk, etc.). If competing as part of a company, only one individual or one team can represent that company, and you must have proper authorization from your employer to register and bind the company to the contest rules. For complete eligibility requirements, please review the full contest rules.
