Port reference
Port 8086 (TCP) – InfluxDB HTTP API
Default port for the InfluxDB HTTP API used to write and query time-series data.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
InfluxDB can run on 0.0.0.0:8086 with authentication disabled by default in older versions. Exposed instances leak metrics and, on vulnerable builds, allow an authentication bypass.
What is port 8086 used for?
Port 8086 is the default for the InfluxDB HTTP API, the interface used to write and query time-series data such as metrics, sensor readings, and monitoring samples. Collectors like Telegraf push data to it, and dashboards like Grafana read from it over HTTP. It is the main port you point InfluxDB clients and the influx CLI at.
When would you open it?
Open or forward 8086 when your collectors, dashboards, or applications need to reach InfluxDB from another machine. Typically it stays on a private network shared with your monitoring stack rather than being exposed to the internet.
Is it safe to open?
Older InfluxDB versions ship without authentication and the API can expose your metrics, so enable auth and keep it on a trusted network or behind TLS. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8086
nmap -p 8086 <target>netstat -ano | findstr :8086
Test-NetConnection <host> -Port 8086lsof -i :8086
nmap -p 8086 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8086 to your device's local IP, internal port 8086, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8086/tcpsudo firewall-cmd --permanent --add-port=8086/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8086 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8086" -Direction Inbound -Protocol TCP -LocalPort 8086 -Action AllowSecurity & risks
Common attacks
- Authentication bypass via CVE-2019-20933 (empty JWT shared secret)
- Unauthenticated reads to query and dump time-series databases
- Information disclosure of metrics, hostnames, and infrastructure detail
- Data deletion or tampering of measurements
Hardening
- Enable authentication and create least-privilege users; set a strong JWT shared secret
- Bind to localhost or a private interface; never expose 8086 to the internet
- Require TLS for the HTTP API
- Firewall 8086 to trusted collectors and dashboards
- Keep InfluxDB patched (fixes CVE-2019-20933) and audit access
How to block this port
sudo ufw deny 8086/tcpsudo firewall-cmd --permanent --remove-port=8086/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8086 -j DROPNew-NetFirewallRule -DisplayName "Block 8086" -Direction Inbound -Protocol TCP -LocalPort 8086 -Action Blocknmap snippet
nmap -p8086 --script http-title <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is CVE-2019-20933 in InfluxDB?
- CVE-2019-20933 is an authentication bypass affecting InfluxDB before 1.7.6. When JWT auth is enabled with an empty shared secret, an attacker can forge tokens and run queries without valid credentials. Patch and set a strong shared secret.
- Is it safe to expose InfluxDB on port 8086?
- No. Exposed InfluxDB leaks metrics and infrastructure detail and may be vulnerable to authentication bypass. Enable auth, require TLS, bind to a private interface, and firewall the port to trusted collectors.