mysqld_exporter exposes a credential path as well as metrics
The MySQL server exporter turns database and InnoDB metrics into a Prometheus scrape target. It usually listens on port 9104. The port count describes an observed service, while the exporter's configuration describes how that service reaches MySQL.
The measurements
The three count-only queries completed on November 5, 2026:
| Query | Matches | UTC time |
|---|---|---|
port="9104" |
10 | 2026-11-05T00:40:21Z |
app="mysqld_exporter" |
0 | 2026-11-05T00:40:22Z |
http.body="mysqld_exporter_build_info" |
5 | 2026-11-05T00:40:24Z |
The application field produced no matches. The body metric found five pages, and the port query found ten. Neither number identifies a vulnerable MySQL server, and neither establishes that every match is reachable from the open internet. The different totals are a reminder to keep the query field visible.
The exporter needs a database account
The exporter connects to MySQL with a user and password. Deployments often pass the credentials as environment variables or through a configuration file. The account should be dedicated to monitoring and limited to the views and metrics the exporter needs.
Do not use an administrative account because the setup is easier. A monitoring account with broad table access extends the impact of an exporter compromise. Review the account's grants, its allowed source hosts, and whether TLS is required for the connection. A password in a process environment may be visible to other processes with the same host access; a protected configuration file may be preferable when the deployment supports it.
The exporter should not be reachable by arbitrary clients. Network access to the scrape endpoint should come from the Prometheus server or a monitoring network. If the endpoint requires authentication, test it through the exact proxy path clients use, including any TLS verification and header rewriting.
Metrics have labels and cardinality
Database exporters can produce many series, especially when they collect per-table or per-query metrics. The exact labels depend on the exporter version and configuration. A public endpoint may reveal database names, schema identifiers, instance names, and version values. High-cardinality series can also consume memory and scrape resources.
Review the configured collectors before enabling them on a production database. A collector that runs expensive SQL can affect database load. A custom collector can read a table that the default review never considered. Use least privilege and remove collectors that do not support an operational decision.
Keep the exporter and the database on trusted networks. A monitoring path should not become a general-purpose HTTP proxy to a database. The exporter's queries should be fixed or loaded from a reviewed configuration file, not selected by an unauthenticated request parameter.
Confirm a match safely
A port match is not enough to send a request. Start with the organization's address inventory, then query the endpoint from a controlled scanner. Check the status code, content type, and metric prefix. Do not fetch large result bodies or run repeated requests against third-party systems.
On an owned host, compare the process start time, listening address, configuration hash, and service account with the deployment record. Inspect the connection from MySQL using an administrative audit view. Confirm that the exporter account is expected and that its source address is allowed.
A small inventory still needs an owner
Ten port matches can be reviewed by hand. The review should produce a list of exporter endpoints, database instances, owners, credentials, and exposure status. Five body matches can identify endpoints that a broad port scan missed.
If the same exporter is reachable from a public network and from the monitoring network, restrict the public path first. Then rotate the monitoring password if the host was reachable by an untrusted party. Finally, verify that the database account cannot read more than the exporter's approved query set.
The port is a discovery signal. The credential scope and network path determine the real impact.
Top comments (0)