Skip to main content
protocols.pageprotocols.page
8086

Port 8086 – InfluxDB

TCP

Port 8086 is the InfluxDB HTTP API port for time-series data ingestion and queries. InfluxDB accepts writes (line protocol), Flux/InfluxQL queries, and serves its web UI on port 8086. Default installations allow unauthenticated access – enable authentication and restrict to monitoring networks in production.

Port Number

8086

Protocol

TCP

Service

InfluxDB HTTP API

Range

IANA Registered (1024–49151)

Description

InfluxDB on port 8086 provides the primary HTTP API for writing time-series data (metrics, events, IoT sensor readings) and querying with Flux or InfluxQL. The write endpoint accepts InfluxDB line protocol – a compact text format for high-throughput ingestion. The web UI (InfluxDB 2.x) also runs on port 8086. InfluxDB 1.x shipped with authentication disabled by default. Exposed instances allowed anyone to write arbitrary data (filling disk) or read all stored metrics. InfluxDB 2.x requires an initial setup token but that token has full admin access. Use fine-grained tokens with specific bucket and org permissions. Bind to internal networks and place behind an authenticating reverse proxy for external access.

Security risks

  • 1CVE-2019-20933 (CVSS 9.8): InfluxDB authentication bypass – empty credentials accepted as valid authentication in InfluxDB before 1.7.6. Attacker gains full read/write access to all databases without credentials.
  • 2No authentication default (1.x): InfluxDB OSS 1.x ships with auth-enabled = false. Any client reaching port 8086 can CREATE DATABASE, DROP DATABASE, SELECT * from all measurements, and write arbitrary data. Enable auth in influxdb.conf immediately.
  • 3Time-series data injection: attackers write false metrics (CPU at 0%, disk at 100%) to trigger or suppress alerts, creating monitoring blind spots during an actual attack or causing alert fatigue from false positives.
  • 4Query resource exhaustion: unbounded SELECT queries (SELECT * FROM measurement) on port 8086 can exhaust server memory. InfluxDB loads query results into memory before responding. Set max-select-point, max-select-series, and max-select-buckets limits.
  • 5Token scope in 2.x: InfluxDB 2.x uses tokens but the initial all-access token created during setup has full admin permissions. Create read-only tokens for dashboards and write-only tokens for agents. Rotate the initial token.

Firewall guidance

Restrict port 8086 to Telegraf agents (write) and Grafana/dashboard servers (read). Never expose to the internet. For InfluxDB 1.x: set auth-enabled = true in influxdb.conf and create admin + read-only users. For InfluxDB 2.x: use bucket-scoped tokens with minimal permissions. Place behind nginx with TLS for cross-network access.

Diagnosis commands

Basic health check (204 = healthy, works without auth)

shell
curl -s http://localhost:8086/ping -w '%{http_code}'

Test if unauthenticated queries work (should return 401 if auth enabled)

shell
curl -s http://localhost:8086/query --data-urlencode 'q=SHOW DATABASES'

List buckets (InfluxDB 2.x with auth)

shell
curl -s -H 'Authorization: Token YOUR_TOKEN' http://localhost:8086/api/v2/buckets | jq '.buckets[].name'

CLI connectivity test

shell
influx ping --host http://localhost:8086

Usage examples

Port 8086 – InfluxDB
shell
curl -XPOST 'http://localhost:8086/write?db=metrics' --data-binary 'cpu,host=srv1 value=0.42'
influx query 'from(bucket:"metrics") |> range(start: -1h)'
curl http://localhost:8086/ping

Common services on this port

InfluxDB OSS 1.xInfluxDB OSS 2.xInfluxDB CloudInfluxDB EnterpriseTelegraf (writes here)Grafana (queries here)

Related ports

8085

InfluxDB relay (deprecated)

8088

InfluxDB backup/restore RPC

9999

InfluxDB 2.x UI (early betas)

History

InfluxDB was created by InfluxData in 2013 as a purpose-built time-series database. Port 8086 was chosen for the HTTP API. InfluxDB 1.x (2015-2020) used InfluxQL (SQL-like). InfluxDB 2.0 (2020) introduced Flux language, built-in dashboards, and token-based auth. InfluxDB 3.0 (2024) rewrote the storage engine in Rust using Apache Arrow and DataFusion, returning to SQL as the primary query language.

FAQ

How do I migrate from InfluxDB 1.x to 2.x securely?

Use influx upgrade CLI tool which migrates databases to buckets and creates DBRP mappings for backward compatibility. Critical: the tool generates an all-access token – immediately create scoped tokens and revoke the all-access one. Enable TLS (tls-cert and tls-key in config.toml). Old 1.x HTTP basic auth stops working – update all Telegraf/Grafana configurations to use Authorization: Token header.

InfluxDB vs Prometheus for metrics?

InfluxDB: push-based (Telegraf pushes), SQL/Flux queries, built-in downsampling (continuous queries/tasks), better for IoT/high-cardinality. Prometheus: pull-based (scrapes targets), PromQL, designed for infrastructure monitoring, better ecosystem (Alertmanager, Grafana native). Use InfluxDB when: you control the writer (IoT sensors, apps). Use Prometheus when: you monitor infrastructure (Kubernetes, servers).