An exposed Blackbox Exporter probe endpoint can become a network relay
The Prometheus Blackbox Exporter measures HTTP, HTTPS, DNS, TCP, ICMP, and gRPC endpoints from the exporter's network position. It is useful precisely because it can reach targets that the monitoring system cannot. An unauthenticated /probe endpoint lets a caller choose a target and cause the exporter to make a request from its own host.
A bounded ZoomEye SDK probe on 2026-11-12 between 00:49:31 and 00:49:34 UTC used sub_type=all, page 1, and a page size of one. The application query app="Blackbox Exporter" returned 0. The title query title="Blackbox Exporter" returned 1,050, and http.body="Blackbox Exporter" returned 30,915. The title result is a candidate set. The body result includes documentation, dashboards, and references and is not a count of monitoring services.
Understand the request direction
The standard multi-target pattern sends a target and module to the exporter. Prometheus supplies the target from its configuration, but the exporter's endpoint accepts the target as a request parameter. If the endpoint is exposed, a third party can attempt to make the exporter reach an internal address, a cloud metadata service, a Unix-adjacent service, or an internet destination. The exporter's output may reveal status, headers, timing, or certificate details.
This is a request-forgery risk even when the service has no stored credentials. The exporter's network position provides the authority. Review its DNS resolution, egress routes, and access to management networks. If the exporter runs in a cluster, determine whether its service account or pod network can reach control-plane or metadata endpoints.
The project's README documents TLS and basic authentication support through a web configuration file. Those settings affect the /metrics, /probe, and web UI endpoints. Enable them when the service is not restricted to a dedicated monitoring network. Network policy is still needed because a valid credential can be shared or leaked.
Keep target selection bounded
The safest deployment lets Prometheus generate targets from reviewed service discovery data and keeps the exporter reachable only from the monitoring system. Restrict egress with a firewall, network policy, or dedicated subnet. Block metadata addresses and administrative networks unless a documented monitoring use case requires them.
Review the module configuration. A module can set the protocol, TLS behavior, redirects, preferred IP protocol, headers, and authentication for the probe. A module with broad redirect following can turn a trusted target into an unexpected sequence of requests. A module with client credentials should be scoped to the target service and stored in a protected configuration file.
The /-/reload endpoint deserves separate attention. The README says a configuration reload can be triggered by a process signal or an HTTP POST to that path. If an unauthenticated caller can change the configuration file or reach the reload path, the probe behavior can change. Treat configuration write access and reload access as administrative controls.
Validate the exposed service
Use the title candidate to find hosts, then confirm the exporter by requesting a harmless non-sensitive path from an approved network. Do not probe arbitrary internal destinations without written authorization. Record the inferred network position, listener port, web configuration file, authentication method, target allowlist, and owner.
For each owned deployment, test an unauthenticated /probe request and confirm the expected denial. Test a target outside the approved list and confirm that egress policy blocks it. Test the reload path. Review logs for target, module, response code, and requester identity, and make sure the logs do not expose probe credentials.
ZoomEye helps discover monitoring services that are visible from the internet. The security review is about the exporter's network authority and request validation. A monitoring tool with a narrow target list and restricted egress is very different from one that accepts arbitrary targets from any caller.
