CVE-2020-16248
** DISPUTED ** Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE:...
CVE-2020-16248 is a medium vulnerability (CVSS 5.8) in Prometheus Blackbox Exporter, published August 9, 2020. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 3.11%, the 87th percentile. Fixed in prometheus-blackbox-exporter 0.18.0-r0.
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
- Record
CVE-2020-16248- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List No score
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
- Record
CVE-2020-16248- Updated
- 2026-11-02
EUVDEUVD-2020-8214 No score
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
- Record
EUVD-2020-8214- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jrj-57gq-475g
** DISPUTED ** Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE:...
** DISPUTED ** Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability.
- Record
GHSA-8jrj-57gq-475g- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-16248
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
- Record
ALPINE-CVE-2020-16248- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
OSV
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
- Record
CVE-2020-16248- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-16248
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
- Record
DEBIAN-CVE-2020-16248- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prometheus-blackbox-exporterAlpine:v3.18 |
before 0.18.0-r0 | 0.18.0-r0 |
prometheus-blackbox-exporterAlpine:v3.19 |
before 0.18.0-r0 | 0.18.0-r0 |
prometheus-blackbox-exporterAlpine:v3.20 |
before 0.18.0-r0 | 0.18.0-r0 |
prometheus-blackbox-exporterAlpine:v3.21 |
before 0.18.0-r0 | 0.18.0-r0 |
prometheus-blackbox-exporterAlpine:v3.22 |
before 0.18.0-r0 | 0.18.0-r0 |
prometheus-blackbox-exporterAlpine:v3.23 |
before 0.18.0-r0 | 0.18.0-r0 |
prometheus-blackbox-exporterAlpine:v3.24 |
before 0.18.0-r0 | 0.18.0-r0 |
prometheus-blackbox-exporterDebian:12 |
All versions, plus listed versions 0.23.0-40.24.0-10.24.0-20.24.0-30.25.0-1 Show 5 moreShow less0.25.0-20.26.0-10.26.0-20.28.0-10.28.0-2 |
None known |
prometheus-blackbox-exporterDebian:13 |
All versions, plus listed versions 0.26.0-10.26.0-20.28.0-10.28.0-2 |
None known |
prometheus-blackbox-exporterDebian:14 |
All versions, plus listed versions 0.26.0-10.26.0-20.28.0-10.28.0-2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF) |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected, aliases, facts, references | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
References
github.com/prometheus/blackbox_exporter/issues/669
prometheus.io/docs/operating/security
openwall.com/lists/oss-security/2020/08/08/3
seclists.org/oss-sec/2020/q3/94
nvd.nist.gov/vuln/detail/CVE-2020-16248
security.alpinelinux.org/vuln/CVE-2020-16248
security-tracker.debian.org/tracker/CVE-2020-16248