Port 9093 – Prometheus Alertmanager

TCP

Port 9093 is the Prometheus Alertmanager HTTP API and web UI port. Alertmanager handles routing, deduplication, and notification delivery for Prometheus alerts. Like Prometheus, it has no authentication by default. Port 9094 is used for Alertmanager cluster gossip between instances in HA setups.

Port Number

9093

Protocol

TCP

Service

Alertmanager HTTP API

Range

IANA Registered (1024–49151)

Description

Alertmanager receives alerts from Prometheus and routes them to receivers: PagerDuty, Slack, email, webhooks. The API on port 9093 allows querying active alerts, silencing alerts, and managing inhibition rules. Publicly exposed Alertmanager reveals active incident state, team contacts, and integration webhook URLs. Use nginx reverse proxy with authentication for any externally reachable deployment.

Security risks

1CVE-2023-40577: Stored XSS in Alertmanager UI via crafted alert labels – attacker sends alert with malicious label, any admin viewing UI executes payload (fixed 0.25.1)
2No authentication on API – anyone can silence alerts (POST /api/v2/silences), hiding active incidents from operators
3Alert suppression attack: adversary creates broad silence matching all alerts, effectively disabling monitoring for the silence duration
4Webhook receiver URLs visible in config API (/api/v2/status) – leaks Slack tokens, PagerDuty keys, and OpsGenie API keys embedded in webhook URLs
5Cluster gossip on port 9094 uses memberlist without encryption – an attacker on the network can join the cluster and inject/suppress alerts

Firewall guidance

Restrict port 9093 to Prometheus servers (which push alerts) and admin workstations. Never expose to the internet – the silence API alone makes it a high-value target. Port 9094 (HA gossip) should only be reachable between Alertmanager peers. Use nginx + basic auth or oauth2-proxy for human access to the UI.

Diagnosis commands

Dump Alertmanager config (check for leaked webhook secrets)

shell

curl -s http://localhost:9093/api/v2/status | jq '.config.original'

List all currently firing alerts

shell

curl -s http://localhost:9093/api/v2/alerts | jq '.[].labels.alertname'

Show active silences (check for unauthorized suppressions)

shell

curl -s http://localhost:9093/api/v2/silences | jq '.[] | select(.status.state=="active") | {id, createdBy, comment}'

CLI tool to query and manage alerts

shell

amtool alert query --alertmanager.url=http://localhost:9093

Usage examples

Port 9093 – Prometheus Alertmanager

shell

curl http://localhost:9093/api/v2/alerts
curl http://localhost:9093/api/v2/silences
amtool alert query --alertmanager.url=http://localhost:9093

Common services on this port

Prometheus AlertmanagerThanos RulerMimir RulerGrafana Alerting

Related ports

9090

Prometheus server

9094

Alertmanager HA gossip (memberlist)

3000

Grafana (alert visualization)

History

Alertmanager was created as part of the Prometheus ecosystem at SoundCloud around 2013. It handles deduplication, grouping, routing, and silencing of alerts from Prometheus. Port 9093 was the next available after Prometheus (9090) and Pushgateway (9091). The v2 API (2019) added structured JSON endpoints. HA mode via gossip was added to avoid single points of failure in alerting.

FAQ

How do I prevent unauthorized alert silencing?

Alertmanager has no built-in auth. Deploy oauth2-proxy or nginx with basic auth in front of port 9093. In Kubernetes, use NetworkPolicy to restrict access to only Prometheus pods and admin namespaces. Monitor for unexpected silences by alerting on alertmanager_silences_active_total increasing.

Alertmanager vs Grafana Alerting?

Alertmanager: battle-tested, supports inhibition rules, native Prometheus integration, complex routing trees (match by label, route to different teams). Grafana Alerting (8.0+): unified UI for alerts across Prometheus/Loki/datasources, simpler setup, built-in contact points. Use Alertmanager when you need inhibition, grouping control, or run pure Prometheus.