ZoomEye finds hundreds of thousands of exposed Prometheus pages

ZoomEye returned 364,475 matches for title="Prometheus" and 198,862 for app="Prometheus" as of 29 October 2026. Exposed Prometheus endpoints reveal metadata, targets and configuration, while the admin API can delete time series and snapshots.

• title="Prometheus" query returned 364,475 matches, app="Prometheus" 198,862
• Admin API is gated by --web.enable-admin-api and can delete data
• Prometheus config may hold passwords, tokens and TLS keys
• Operators should put UI and API behind auth and private network