Google Launches $250,000 Cloud VRP Reward for 'Root-in-Cloud' Vulnerabilities
Google has introduced a new top-tier reward of $250,000 within its Cloud Vulnerability Reward Program (VRP) for researchers who identify Root-in-Cloud bugs — critical architectural flaws such as tenant-isolation bypasses and cross-service logic errors that grant full administrative control over arbitrary Google Cloud organizations. To qualify, researchers must demonstrate complete IAM/owner-level control without prior access, compromised credentials, social engineering, or user interaction. Reports showing remote code execution in Google's production infrastructure (Borg) may also be automatically evaluated for Root-in-Cloud eligibility. This expansion follows Google's October suspension of its Open Source Software VRP due to a flood of AI-generated low-quality submissions, and comes after a record $17.1 million paid to researchers in 2025.
Detalhes técnicos
To prevent risk to real customer environments, Google created a deterministic proof-of-root mechanism using a designated service account, allowing researchers to cryptographically prove unauthorized access without touching live customer projects. Researchers who achieve code execution on Google's production infrastructure must immediately stop testing; further escalation, credential theft, or lateral movement results in disqualification. Full technical specifications, including endpoint details, JSON payloads, and CLI examples, are published on Google's Cloud VRP rules page.
Remediação
This is a bug bounty program expansion rather than a vulnerability disclosure; no remediation action is required from defenders.
Linha do tempo
-
Google Launches $250,000 Cloud VRP Reward for 'Root-in-Cloud' Vulnerabilities
ler a análise desta fonte ocultar
Google has introduced a new top-tier reward of $250,000 within its Cloud Vulnerability Reward Program (VRP) for researchers who identify Root-in-Cloud bugs — critical architectural flaws such as tenant-isolation bypasses and cross-service logic errors that grant full administrative control over arbitrary Google Cloud organizations. To qualify, researchers must demonstrate complete IAM/owner-level control without prior access, compromised credentials, social engineering, or user interaction. Reports showing remote code execution in Google's production infrastructure (Borg) may also be automatically evaluated for Root-in-Cloud eligibility. This expansion follows Google's October suspension of its Open Source Software VRP due to a flood of AI-generated low-quality submissions, and comes after a record $17.1 million paid to researchers in 2025.
Technical Details
To prevent risk to real customer environments, Google created a deterministic proof-of-root mechanism using a designated service account, allowing researchers to cryptographically prove unauthorized access without touching live customer projects. Researchers who achieve code execution on Google's production infrastructure must immediately stop testing; further escalation, credential theft, or lateral movement results in disqualification. Full technical specifications, including endpoint details, JSON payloads, and CLI examples, are published on Google's Cloud VRP rules page.
Remediation
This is a bug bounty program expansion rather than a vulnerability disclosure; no remediation action is required from defenders.