AEV-2026-0020
Grafana MCP server side request forgery through a caller supplied X-Grafana-URL header (CVE-2026-19516)
A caller supplied X-Grafana-URL header, combined with the grafana_api_request tool, let a caller redirect the Grafana MCP server's own outbound requests to internal, loopback and link local destinations, cloud metadata endpoints included, and read the responses. Disclosed by Grafana Labs, CVSS 9.1, fixed in mcp-grafana v1.1.0, with no evidence found of exploitation against a real deployment.
Affected
- Organisation
- Grafana Labs
- Product
- Grafana MCP Server (mcp-grafana)
- Component
- grafana_api_request tool's X-Grafana-URL destination handling
- Versions
- Versions before 1.1.0; fixed in 1.1.0
- Configurations
- Grafana MCP server deployed with grafana_api_request enabled and reachable to a caller
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- An MCP caller querying the operator's configured Grafana instance through the grafana_api_request tool
- Agent
- mcp-grafana, the Grafana MCP server
- Delegating actor
- The operator who deployed and configured the Grafana MCP server
- Action
- Directed the server's own outbound request, through a caller supplied X-Grafana-URL header, at internal, loopback and link local destinations and read the response
- Target resource
- Internal, loopback and link local network services reachable from the server's own network position, cloud metadata endpoints included
- Environment
- Wherever the operator deployed the Grafana MCP server, typically inside the operator's own network
- Credentials used
- unknown
- Privileges available
- The Grafana MCP server's own network reachability from its deployment location
- Authority presented
- A caller's admission to invoke the grafana_api_request tool against the configured Grafana instance
- Authority required
- Authorization for the specific destination the caller directed the server's outbound request to
- Applicable policy
- unknown
- Approval mechanism
- unknown
- Required approver
- unknown
- Independent approval
- no
- Action binding
- The tool's authority bound to invoking the configured Grafana instance; the destination itself was not independently bound to that authorization
- Sequence context
- unknown
Impact
- Consequence
- Internal, loopback and link local services, cloud metadata endpoints included, made reachable and their responses readable by the caller
- Reach
- The network position of wherever the operator deployed the Grafana MCP server, potentially reaching multiple internal services inside that deployment
- Reversibility
- unknown
- Detectability
- unknown
- Propagation
- A documented path existed combining this SSRF with a separately reported session validation gap; not established as observed operating against a real deployment
- Recovery
- Fixed by restricting the destination in mcp-grafana v1.1.0; no process described for a request that may have already reached an unintended destination before the fix was applied to a given deployment
Evidence
Primary sources
- A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests (CVE-2026-19516) (GitHub Advisory Database (mirroring Grafana Labs))
Supporting sources
- CVE-2026-19516 (Grafana Labs (Security Advisories))
- A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate credentials (CVE-2026-15583) (GitHub Advisory Database (mirroring Grafana Labs))
- Releases: grafana/mcp-grafana (Grafana Labs, grafana/mcp-grafana (GitHub))
- Valid but Never Issued: Session Spoofing and SSRF in Grafana MCP (Pillar Security)
- Reproduction status
- Vendor disclosed and patched; Pillar Security reported a controlled demonstration of an IMDSv2 style request sequence, not independently reproduced by Moona
- Evidence state
- Confirmed
Known unknowns
- How many production deployments ran the vulnerable configuration before the fix.
- Whether any deployment was reached through this path by a party other than Pillar Security's own researchers.
- Whether Pillar's demonstrated request sequence reached a real cloud metadata service or a constructed stand in.
Limitations
- Grafana's own advisory page was not directly readable in this session; its content is read through GitHub's mirror of the advisory and corroborated through search.
- Pillar Security's own research page was not directly readable in this session; its findings are corroborated through convergent search results rather than a direct read.
Claim provenance
- verified
Grafana's own advisory, read directly through GitHub's mirror, assigns CVE-2026-19516, rates it CVSS 9.1 Critical under CWE-918, and states the X-Grafana-URL and grafana_api_request mechanism directly.
The Caller Had Access to the Tool. The Server Had Access to Everything Behind It. - verified
The prior CVE-2026-15583 advisory, also read directly, establishes that the earlier fix addressed credential exfiltration only, leaving the destination itself unrestricted until this vulnerability's own fix.
The Caller Had Access to the Tool. The Server Had Access to Everything Behind It. - independent-reporting
Pillar Security's research, corroborated through convergent search rather than a direct read, reports a separate session validation finding and a controlled IMDSv2 style demonstration combining it with this SSRF.
The Caller Had Access to the Tool. The Server Had Access to Everything Behind It.