“Such misconfigurations allow anyone to query the exposed environments to list labels or metrics.”
Shodan turns up about 296,000 exporters and 40,000 Prometheus servers on the open internet, many with no authentication and some leaking credentials and API keys. An exposed pprof endpoint was enough to knock an EC2 host offline until reboot. Skoda had one sitting open with its Docker registries listed. The Prometheus security team’s answer was that good production practices beat protecting users from gross misconfiguration. Three hundred thousand operators disagree by example.