Blackbox Exporter - SSRF (CVE-2020-16248)
Description
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
psychologyCrowdSec Analysis
CVE-2020-16248 is a server-side request forgery (SSRF) vulnerability in Prometheus Blackbox Exporter through version 0.17.0, where the /probe?target= endpoint can be abused to make arbitrary network requests. This flaw could allow remote attackers to leverage the exporter to access internal resources or services that would otherwise be inaccessible, potentially exposing sensitive information.
CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2020-16248 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /probe endpoint by supplying a crafted target parameter, enabling server-side request forgery (SSRF) to access internal resources or external domains.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2020-08-09 |
| Rule Released | 2026-02-11 |
Remediation & Protection
External References
- https://github.com/prometheus/blackbox_exporter/issues/669
- https://prometheus.io/docs/operating/security/#exporters
- https://www.openwall.com/lists/oss-security/2020/08/08/3
- https://www.openwall.com/lists/oss-security/2020/08/08/12
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16248.yaml