Grafana discloses critical SSRF in mcp-grafana after an earlier fix left request destinations unrestricted
Grafana published CVE-2026-19516 on 2026-08-11, a CVSS 9.1 server-side request forgery in the mcp-grafana server. A caller-supplied X-Grafana-URL header controls the destination of outbound requests, and the grafana_api_request tool also lets the caller choose the HTTP method, path, and body, so requests can be directed at internal, loopback, and link-local services including metadata endpoints. The fix for the earlier CVE-2026-15583 stopped token leakage but did not restrict destinations; v1.1.0 fixes the SSRF and adds optional bearer-token caller authentication.
Grafana published a security advisory for CVE-2026-19516 on 2026-08-11,
rating it critical with a CVSS score of 9.1. In affected versions of
mcp-grafana, Grafana's first-party MCP server, a caller-supplied
X-Grafana-URL request header controls the destination of the server's
outbound requests, and the grafana_api_request tool lets the caller
also choose the HTTP method, path, and body. Because the destination is
not restricted to the configured Grafana instance, a caller can direct
requests at internal, loopback, and link-local network services,
including metadata endpoints, and read the responses back: a
server-side request forgery.
The advisory frames the flaw as a gap left by an earlier fix. The patch for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations, but did not restrict the destinations themselves. CVE-2026-19516 closes that remaining vector.
The fixed release, v1.1.0, was published on 2026-08-10. Beyond the SSRF
fix, it adds optional bearer-token caller authentication for the SSE
and streamable-http transports via a --server-auth-token flag or the
MCP_GRAFANA_SERVER_TOKEN environment variable; when set,
unauthenticated requests are rejected with a 401 before any tool runs.
Grafana's guidance is to upgrade to 1.1.0 or later.
How was this verified, and what are the sources?
Published · last verified · confidence 1.00.
- Grafana security advisory CVE-2026-19516 (published 2026-08-11) - critical, CVSS 9.1: caller-supplied X-Grafana-URL header controls mcp-grafana's outbound request destination; grafana_api_request lets the caller choose HTTP method, path, and body; fixed in 1.1.0; described as a bypass of the CVE-2026-15583 fix, which prevented credential leakage but "did not restrict the destinations themselves" - accessed
- mcp-grafana v1.1.0 release notes (published 2026-08-10) - adds optional bearer-token caller authentication for the SSE and streamable-http transports via --server-auth-token / MCP_GRAFANA_SERVER_TOKEN, rejecting unauthenticated requests with 401 before any tool runs - accessed
- NVD record for CVE-2026-19516 (published 2026-08-11) - confirms the description and the reference to the Grafana advisory - accessed