In brief. Apache Kafka (European Commission - DIGIT) is a bug bounty program on HackerOne. It received 0 reports in the 90 days to November 10, 2026, about 0 per in-scope asset. As of Nov 10, 2026. Markdown for agents

NR Unrated

Apache Kafka (European Commission - DIGIT)

Apache Kafka (European Commission - DIGIT) HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at Apache Kafka (European Commission - DIGIT)? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 10 Nov 2026.

What it pays, by severity

Critical no reports on record

High no reports on record

Medium no reports on record

Low no reports on record

Intake & responsiveness, last 90 days

Reports received

in 90 days

Resolved

not published

all time

Participants

hunters engaged

Response efficiency

not published

HackerOne’s figure

SLA misses

targets missed

Reports received, day by day, last 29 days 0–0

12 Oct 0 reports 10 Nov

Response targets it sets itself

First response

1 day

Triage

2 days

Bounty

30 days

Resolution

30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

submissions paused

Over 80 days (56 snapshots): no change in the main figures.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

1 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	xxlegend	0	0 / 3 0%

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 5 Nov 2026.

Swag

Currency

USD

Submissions

Paused

Launched

Jan 2019

Scope entries

1 HackerOne’s count

Scope

1 asset

Asset	Type	Eligibility	Max severity
https://github.com/apache/kafka	SOURCE CODE	✓ bounty	Critical

Known vulnerabilities in in-scope packages

18 from OSV.dev

Published vulnerabilities in the packages and repositories this program lists in scope, from the open OSV.dev database. They are already public, so they are context for where the code has broken before, not findings to report.

Advisory	Package	Severity	Published
CVE-2026-83525 Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller vi…	github.com/apache/kafka	CVSS	28 Oct 2026
CVE-2026-41115 Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API	github.com/apache/kafka	CVSS	2 Jun 2026
CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication	github.com/apache/kafka	CVSS	20 Apr 2026
CVE-2026-33558 Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output	github.com/apache/kafka	CVSS	20 Apr 2026
CVE-2026-35554 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition	github.com/apache/kafka	CVSS	7 Apr 2026

Showing the newest 5 of 18.