1659 MQTT, 2503 InfluxDB and 45150 ClickHouse Results: The Data Pipeline Layer

Five data pipeline services, MQTT, InfluxDB, ClickHouse, Cassandra, and Elasticsearch, were queried on September 22, 2026. The results revealed a wide distribution of active ports: ClickHouse exposed 45,150 on HTTP, InfluxDB reported 2,503 on HTTP, MQTT logged 1,659, Cassandra had 15,906, and Elasticsearch logged 1,550. These services are often employed as components of managed platforms, typically residing on public interfaces due to their integral role in observability and analytics stacks.

ClickHouse's vast result count stems from its HTTP interface, which is the most commonly used client library. InfluxDB's HTTP API, while less secured, is the primary administrative interface. MQTT brokers, with a moderate count of 1,659, are unencrypted and often permit anonymous connections, posing a risk for command injection in IoT deployments.

Cassandra and Elasticsearch, while less queried, also present potential security concerns due to their optional authentication and historically unsecured access patterns. The under-management of these services, often attributed to their integration into application stacks and lack of inclusion in security team inventories, underscores the need for proactive checks.

Specifically, scanning netblocks for the listed ports, inspecting listen addresses, auditing authentication states, verifying data classification, and reviewing cloud security group rules are crucial steps in securing these data pipeline layers.