GoKawiilGoogle Cloud offers $250,000 top reward for Root-in-Cloud exploits
Google has added a new top-tier payout to its Cloud Vulnerability Reward Program, offering $250,000 for bugs that let attackers gain full administrative control over arbitrary Google Cloud organizations or projects without prior access. Qualifying flaws include tenant-isolation bypasses and complex cross-service logic errors, and reports showing remote code execution on Google's internal Borg infrastructure will also be reviewed for eligibility under this top reward tier.
GoKawiil's interpretation of the reporting above, not reported fact.
The large bounty signals that Google views architectural isolation failures in its cloud platform as a top security priority, likely reflecting the high potential damage from any flaw allowing cross-tenant administrative access. By requiring proof against a designated service account rather than real customer projects, Google appears to be balancing strong incentives for researchers with controls meant to prevent actual harm to its cloud customers.
- New $250,000 reward targets 'Root-in-Cloud' bugs granting full admin control over Google Cloud organizations.
- Exploits must work without prior access, stolen credentials, or social engineering to qualify.
- Researchers must use a designated service account for proof-of-concept rather than testing on real customer projects.
Source: bleepingcomputer.com, 2026-11-03
Published there as: “Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.