CVE-2026-19516: mcp-grafana SSRF Vulnerability

CVE-2026-19516 Overview

CVE-2026-19516 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Grafana's mcp-grafana component. The X-Grafana-URL request header controls the destination of outbound requests, and the grafana_api_request tool allows callers to select the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, an authenticated caller can redirect requests toward internal, loopback, and link-local network services, including cloud metadata endpoints, and read the responses.

Critical Impact
An authenticated attacker can pivot mcp-grafana into internal networks, reach cloud metadata endpoints, and exfiltrate response data.

Affected Products

Grafana mcp-grafana (Model Context Protocol server for Grafana)
Deployments exposing the grafana_api_request tool to callers
Environments that previously applied the CVE-2026-15583 fix without destination restrictions

Discovery Timeline

2026-08-11 - CVE-2026-19516 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-19516

Vulnerability Analysis

The mcp-grafana server acts as a bridge between MCP clients and a configured Grafana instance. Under normal operation, it forwards API requests to the operator-configured Grafana URL using a service-account token. The vulnerability arises because the server honors a caller-supplied X-Grafana-URL header to determine the outbound destination for every request. Combined with the grafana_api_request tool, which exposes control over HTTP method, path, and body, a caller can craft arbitrary HTTP requests to any reachable host.

A prior fix for CVE-2026-15583 stopped the configured service-account token from being sent to unintended destinations. That fix addressed credential leakage but did not restrict the destinations themselves. Requests can still be issued and responses returned to the caller.

Root Cause

The root cause is missing destination validation. The server treats X-Grafana-URL as authoritative without enforcing an allowlist that limits outbound requests to the configured Grafana instance. This is a classic SSRF pattern [CWE-918] where user-influenced input controls the target of a server-side network call.

Attack Vector

An authenticated caller with access to the grafana_api_request tool submits a request containing an attacker-controlled X-Grafana-URL header. The header targets internal services such as 127.0.0.1, RFC1918 addresses, or the cloud metadata endpoint 169.254.169.254. The server issues the specified HTTP method, path, and body toward that destination and returns the response to the caller, enabling internal reconnaissance and metadata harvesting.

See the Grafana Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-19516

Indicators of Compromise

Outbound HTTP requests from mcp-grafana hosts to loopback (127.0.0.0/8), link-local (169.254.0.0/16), or RFC1918 addresses.
Requests with X-Grafana-URL header values that do not match the configured Grafana instance.
Access patterns to cloud metadata paths such as /latest/meta-data/ or /computeMetadata/v1/ originating from the mcp-grafana process.
Invocations of the grafana_api_request tool with unusual HTTP methods or paths inconsistent with normal Grafana API traffic.

Detection Strategies

Inspect mcp-grafana access and application logs for the X-Grafana-URL header and alert when its value diverges from the configured Grafana URL.
Correlate MCP tool invocations of grafana_api_request with the actual destination host resolved from the header.
Deploy egress network monitoring on mcp-grafana workloads to flag connections to internal or metadata IP ranges.

Monitoring Recommendations

Forward mcp-grafana logs and network flow data into a centralized data lake for correlation and retention.
Track baseline destinations for mcp-grafana outbound traffic and alert on deviations.
Monitor cloud IMDS access logs where available and treat any hit from application workloads as high priority.

How to Mitigate CVE-2026-19516

Immediate Actions Required

Upgrade mcp-grafana to the fixed release referenced in the Grafana Security Advisory.
Restrict which callers can invoke the grafana_api_request tool and audit existing access.
Rotate any credentials or tokens that may have been exposed via cloud metadata endpoints.
Place mcp-grafana workloads behind egress controls that block internal, loopback, and link-local destinations.

Patch Information

Refer to the Grafana Security Advisory for the fixed versions and release notes. The patch restricts outbound request destinations rather than only preventing credential forwarding, closing the gap left by the earlier CVE-2026-15583 remediation.

Workarounds

Disable or gate the grafana_api_request tool if immediate patching is not possible.
Enforce egress firewall rules on mcp-grafana hosts to block traffic to loopback, RFC1918, and 169.254.169.254.
Require IMDSv2 with hop-limit enforcement on AWS to reduce the impact of metadata access.
Terminate mcp-grafana outbound traffic through a proxy that enforces an allowlist limited to the configured Grafana instance.

bash

# Example egress restriction using iptables on the mcp-grafana host
# Block link-local metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
# Block loopback egress from the mcp-grafana service user (uid 1001 example)
iptables -A OUTPUT -m owner --uid-owner 1001 -d 127.0.0.0/8 -j REJECT
# Block RFC1918 ranges except the configured Grafana subnet
iptables -A OUTPUT -m owner --uid-owner 1001 -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1001 -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1001 -d 192.168.0.0/16 -j REJECT