postgres_exporter counts are a database-monitoring inventory
The postgres exporter connects to PostgreSQL and turns database metrics into a Prometheus endpoint. Its default port is 9187. A public listener can reveal database activity and connection state; the exporter's own configuration also holds a credential that reaches the database.
The measurements
The count-only queries ran on November 5, 2026:
| Query | Matches | UTC time |
|---|---|---|
port="9187" |
5 | 2026-11-05T00:40:17Z |
app="postgres_exporter" |
0 | 2026-11-05T00:40:18Z |
http.body="postgres_exporter_build_info" |
2 | 2026-11-05T00:40:20Z |
All queries succeeded. The application field returned zero matches, so the current fingerprint does not identify the exporter. The body metric is more specific, but two matching pages do not prove two exposed exporters. They may include duplicate views, cached pages, or a metrics sample.
The small counts are still actionable. A low population is easier to enumerate and verify than a large one. Search results should be joined to organization-owned addresses and assets, then checked with a controlled request from an approved host.
The exporter has a database password
The exporter must authenticate to PostgreSQL. Common deployments use a dedicated account and a connection string supplied through configuration or the environment. The connection string can contain a username, password, host, port, database, and TLS parameters.
If the exporter endpoint becomes reachable, the immediate risk is information disclosure through its metrics. The larger risk is exposure of the credential store or the process environment on the host. A misconfigured debug path, a copied configuration file, or a compromised exporter process can expose the database credential even when the metrics endpoint itself requires a network-level restriction.
Use an account with only the privileges needed by the exporter's queries. Avoid the database superuser. Keep the credential in a protected file or secret service, restrict access to the exporter's runtime user, and rotate it when the exporter host is rebuilt or removed.
Metrics reveal operational context
Database metrics can include connection counts, query activity, replication state, database names, and server version labels. Some custom queries expose application-specific information. The exact set depends on the exporter configuration and PostgreSQL version.
The security review should list every enabled metric family and every SQL query the exporter runs. A query that reads a protected table may turn the exporter into an indirect read surface. A query with expensive joins can also become a denial-of-service path when a caller can repeatedly request the scrape endpoint.
Keep the exporter's collection interval bounded and apply a timeout. Do not let an unauthenticated client trigger arbitrary SQL. The exporter's query set should be static or governed by a reviewed configuration file.
Restrict access at the network layer
Bind the exporter to an internal address. Allow only the Prometheus server or a defined monitoring subnet to reach it. Where the deployment supports it, enable TLS and authentication through the exporter toolkit configuration and keep the certificate material outside a world-readable directory.
Test the boundary from the monitoring network and from an ordinary user network. The first request should succeed and return metrics. The second should fail before the exporter reaches PostgreSQL. Also test a request with an invalid TLS certificate or missing authentication to confirm that the failure is closed.
On the database side, set max_connections headroom and use a dedicated connection pool. Confirm that an unavailable exporter does not lock accounts or exhaust database sessions during a restart. Monitoring availability should not create a new outage.
Treat the count as an inventory lead
Five port matches or two body matches are not a confirmed vulnerability count. Use them to ask which managed PostgreSQL environments have an exporter, where that exporter listens, which credential it uses, and whether the endpoint is reachable from outside the monitoring plane. Record the port, query, collection time, and scope with every result.
The useful security outcome is a complete exporter inventory with known owners and credentials. A public count can show that an inventory gap exists, but it cannot close that gap.
Top comments (0)