# CVE-2020-16248: Blackbox Exporter - SSRF

> Live exploitation tracking for CVE-2020-16248 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-16248

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.8
- **Public exploit available:** Yes
- **Affected products:** Prometheus Blackbox Exporter
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** web_application

## Description

Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability

## CrowdSec analysis

[CVE-2020-16248](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-16248) is a server-side request forgery (SSRF) vulnerability in Prometheus Blackbox Exporter through version 0.17.0, where the /probe?target= endpoint can be abused to make arbitrary network requests. This flaw could allow remote attackers to leverage the exporter to access internal resources or services that would otherwise be inaccessible, potentially exposing sensitive information.

CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2020-16248 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/probe` endpoint by supplying a crafted `target` parameter, enabling server-side request forgery (SSRF) to access internal resources or external domains.

## Timeline

- 2020-08-09: CVE Published. CVE-2020-16248 is published to NVD.
- 2026-02-11: Rule Released. CrowdSec releases a rule to detect CVE-2020-16248 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/prometheus/blackbox_exporter/issues/669
- https://prometheus.io/docs/operating/security/#exporters
- https://www.openwall.com/lists/oss-security/2020/08/08/3
- https://www.openwall.com/lists/oss-security/2020/08/08/12
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16248.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-16248) follows observed exploitation activity for CVE-2020-16248. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.