TCP 9090
Synopsis
- Prometheus server listens on TCP 9090 for its web UI and HTTP API by default.
- Cockpit (the Linux system web console for RHEL/Fedora/Debian, etc.) serves its HTTPS management interface on port 9090.
- Openfire XMPP server’s admin console uses 9090 for HTTP (9091 for HTTPS); this interface has been exploited in the wild (e.g., CVE-2023-32315 auth bypass leading to RCE) when exposed.
- Foreman Smart Proxy (used by Foreman and Red Hat Satellite “Capsule”) commonly exposes its management API on TCP 9090.
- Apache HBase’s Thrift server defaults to port 9090 for Thrift client connections.
- Clash and Clash for Windows expose their local REST API and dashboard on 9090; misconfigured public exposure has been abused to relay traffic or alter proxy settings.
- Bundled Prometheus instances inside platforms (for example, GitLab’s embedded Prometheus) also use 9090.
Observed activity
Last 30 days
Detailed chart