CVE-2026-19516

Name of the Vulnerable Software and Affected Versions mcp-grafana versions prior to 1.1.0

Description An authentication bypass allows unauthenticated attackers to use self-generated session IDs to gain access to the server's Grafana service account. This can be chained with a server-side request forgery (SSRF) where a caller-supplied X-Grafana-URL request header controls the destination of outbound requests. Through the grafana api request() function, a caller can specify the HTTP method, path, and body. Because destinations are not restricted to the configured Grafana instance, attackers can direct requests to internal, loopback, and link-local network services, including cloud metadata endpoints, and read the responses. The server has reached approximately 1.9 million Docker Hub downloads.

Recommendations Update mcp-grafana to version 1.1.0 or later.