hunt-rce

Crown Jewel Targets

RCE is the highest-paying class in bug bounty, and the 24-month meta has shifted decisively toward five asset types. All CVEs below are verified against NVD.

1. Modern JS framework deserialization (CVSS 10.0). React Server Components / React Server Functions / Next.js App Router. CVE-2025-55182 (CVSS 10.0, Meta Bug Bounty, Vercel WAF-bypass program on H1, exploited in the wild within 24 hours of disclosure) is the defining 2025-2026 RCE. Every Next.js >=14.3.0-canary.77 / >=15.x / >=16.x deployment running unpatched RSC is a one-request RCE target. Vercel maintains a separate H1 program paying low five-figure bounties for WAF bypasses against this CVE. Hunt this first on any modern JS stack.

2. CI/CD runners and GitOps controllers. GitHub Actions pull_request_target script injection, GitLab CI runner takeover, Jenkins script console, Tekton/ArgoCD/Flux git resolvers. CVE-2026-40938 (Tekton git resolver --upload-pack argument injection — CVSS 9.4, NVD-verified, fix in v1.11.1) and CVE-2026-24685 (OpenProject git argument injection in repository diff endpoint, CVSS 9.4) define the 2026 GitOps meta. CI compromise = supply-chain compromise; bounties scale accordingly. GitHub Security Lab pays for these directly; downstream programs (Cilium, ArgoCD, Tekton are all CNCF graduates) often have parallel bounty programs.

3. Container runtimes and admission controllers. CVE-2024-21626 (runc "Leaky Vessels" — CISA KEV, CVSS 8.6, Snyk Labs disclosure) gives you full host RCE from any pod with runc exec. CVE-2024-23653 (BuildKit GRPC SecurityMode missing privilege check) breaks out at build time. CVE-2024-0132 (NVIDIA Container Toolkit TOCTOU, Wiz Research) covers the GPU-rich infrastructure stack. CVE-2025-1974 (ingress-nginx admission controller RCE, CVSS 9.8) — any pod-network attacker reads cluster-wide Secrets. Hunt these on every Kubernetes target where you can deploy a pod.

4. ML serving / inference platforms. CVE-2025-27520 (BentoML deserialize_value() unsafe pickle on /summarize, CVSS 9.8 critical, c2an1 disclosure via Snyk) and CVE-2025-32375 (BentoML runner server, GHSA-7v4r-c989-xh26) demonstrate the universal pattern — model registries deserialize pickled tensors and trust the format. CVE-2024-2912 (BentoML earlier pickle, Toreon disclosure). CVE-2024-1560/1483/1594 (MLflow path traversal family, all via Huntr) reach arbitrary file read/write on the model server. Hunt model registry endpoints, inference servers, and Content-Type: application/vnd.*+pickle accepting handlers.

5. Agentic LLM tool-use. CVE-2025-68613 (LangChain langchain-experimental PythonREPLTool / PandasDataFrameAgent — CVSS 9.8 critical, "Semantic RCE") is the new attack class. Indirect prompt injection in CSV/text/RAG context coerces the agent into writing exec()-able Python. Same pattern hits LlamaIndex code interpreter, MCP servers with shell tools, Ollama plugins. The agent is the gadget chain.

6. Internet Bug Bounty / OSS supply chain. nodejs, curl, git, python, php, rails, marked, phpoffice/phpspreadsheet, GitPython, coredns, jackson-databind, log4j, snakeyaml. A single bug here cascades downstream into thousands of apps. The 2026 corpus shows curl alone with multiple critical/high RCEs (--engine arbitrary library load via H1 disclosed report, short-flag grouping argument injection, SFTP QUOTE path traversal, libcurl cookie buffer overflow). Bounties scale with downstream blast radius.

7. Government & enterprise asset surfaces (deptofdefense pattern). Old log4j, Confluence (CVE-2023-22527 OGNL injection at /template/aui/text-inline.vm), Liferay (CVE-2020-7961), Pentaho with default creds, Cisco IOS XE, GlobalProtect (still paying via H1 disclosed 2025-2026) — all still paying on intranets and forgotten subdomains. Old CVEs against old assets is a paying strategy. Apache Tomcat CVE-2024-50379 (write-enabled default servlet RCE via JSP race condition, CVSS 9.8) joined the rotation in 2024-2025.

Admin panels with file/asset upload. Anywhere ops staff upload images, configs, themes, packages. Screenshot URLs piped to shell, ZIP extraction without extension filter, theme installer running unzip then serving the public dir. Grav SSTI/direct-install (multiple Snyk advisories), WPML Twig SSTI (Patchstack disclosure).