Skip to content

Back to the catalog

Grafana fixes critical SSRF flaw affecting Grafana MCP servers
scworld.comadvisory

Grafana fixes critical SSRF flaw affecting Grafana MCP servers

Grafana patched CVE-2026-19516 (CVSS 9.1), a critical SSRF in the Grafana MCP server's grafana_api_request tool where a caller-supplied X-Grafana-URL header could control the method, path and body of outbound requests, letting an attacker reach internal-only services from the server's network position. Pillar Security researchers chained this with a second flaw — the MCP server accepting unauthenticated "session-shaped IDs" it never issued — and demonstrated using it to hit the AWS IMDSv2 endpoint and retrieve cloud credentials via a two-step PUT/TTL token request. Grafana MCP v1.1.0 adds optional bearer-token auth to close the session-forgery gap; Pillar frames MCP servers broadly as "identity brokers" that need explicit outbound destination policies and mandatory auth for remote deployments.

TL;DR Grafana MCP server had a critical SSRF (CVE-2026-19516, CVSS 9.1) chainable with a session-forgery auth bypass to steal AWS IMDSv2 cloud credentials, patched in v1.1.0.
Open original ↗
Document

What the summary omits

The summary fully covers CVE-2026-19516, the session-forgery flaw, the IMDSv2 chain, and the v1.1.0 fix. Two things on the page it does not carry:

A prior, related CVE. Grafana previously patched CVE-2026-15583, which prevented the Grafana service-account token from being exfiltrated to external websites via a crafted X-Grafana-URL header. This is a distinct, earlier fix in the same header/tool surface — worth knowing if you're auditing which Grafana MCP versions you run, since it establishes that X-Grafana-URL abuse has been patched more than once.

Scope boundary on the new flaw. Pillar explicitly confirmed that CVE-2026-19516 does not let the caller obtain the service-account token itself. The exposure is the server acting as a "readable, method-capable proxy from its own network location" — not credential theft from Grafana directly. So the two CVEs address different assets: CVE-2026-15583 the token, CVE-2026-19516 the network-position proxy.

Vendor framing of the session gap. Grafana treated the session-validation change (bearer-token auth in v1.1.0) as "a security improvement rather than a vulnerability," not a patched CVE. If you're tracking this by CVE ID alone, the session-forgery fix will not appear as one — it lands only through the v1.1.0 upgrade. That matters for how you justify and record the upgrade internally.

What to do

Upgrade to Grafana MCP v1.1.0, which fixes CVE-2026-19516 and adds the optional bearer-token auth. Note the auth is optional — enable it explicitly for remote deployments; the version bump alone does not force it on. Apply an explicit outbound destination policy to any tool capable of issuing HTTP requests, per Pillar's recommendation.

Caveat

Pillar notes the IMDSv2 credential retrieval is not universal: "This does not mean that every Grafana MCP deployment could reach cloud metadata." Reachability depends on the server's network position. The demonstration shows the property (proxy capability), not that every deployment is exploitable to cloud-credential theft.

Organisations named here

  • Ariel Fogel
  • IMDSv2

CVEs named here

  • CVE-2026-19516
  • CVE-2026-15583

Technologies named here

  • Grafana MCP
  • Grafana MCP server
  • Grafana
  • Model Context Protocol
  • AWS
  • Pillar Security

Techniques named here

  • SSRF
  • Session ID forgery / unauthenticated tool calls
  • Killchain combining SSRF and unauthenticated tool calls
  • Cloud metadata credential theft via IMDSv2

Related in AppSec