CVE-2023-26735
This vulnerability allows attackers to detect intranet ports and services, as well as download resources.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.89%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources. NOTE: this is disputed by third parties because authentication can be configured.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.89% probability · 58th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-918
- Affected
- prometheus/blackbox exporter
- Source
- cve@mitre.org
EPSS 0.9% since 6 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/prometheus/blackbox_exporter#tls-and-basic-authenticationProduct
- https://github.com/prometheus/blackbox_exporter/issues/1024Issue Tracking
- https://github.com/prometheus/blackbox_exporter/issues/1025Issue Tracking
- https://github.com/prometheus/blackbox_exporter/issues/1026Issue Tracking
- https://github.com/prometheus/blackbox_exporter#tls-and-basic-authenticationProduct
- https://github.com/prometheus/blackbox_exporter/issues/1024Issue Tracking
- https://github.com/prometheus/blackbox_exporter/issues/1025Issue Tracking
- https://github.com/prometheus/blackbox_exporter/issues/1026Issue Tracking
- https://github.com/prometheus/blackbox_exporter#tls-and-basic-authenticationProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.