mcp-grafana CVE-2026-19516

The attacker must be able to invoke the mcp-grafana grafana_api_request tool (CVSS PR:L-an authenticated/authorized MCP caller, not fully anonymous), and the deployment must expose that tool. Exploitation specifically requires the ability to set the X-Grafana-URL request header, which controls the outbound destination; the tool additionally lets the caller pick the HTTP method, path, and body. Value is highest when the server sits in a network with reachable internal or cloud-metadata endpoints (e.g., a cloud VPC exposing 169.254.169.254). Limiting factors: it is not unauthenticated (a valid caller is required), the grafana_api_request tool must be enabled/exposed, and impact depends on what internal services are reachable from the server's network position; egress filtering or header stripping at a proxy defeats it.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, base 9.1) indicates a network-reachable, low-complexity attack requiring only low privileges (a valid MCP caller) with no user interaction, and a scope change reflecting that the server reaches systems beyond its own trust boundary-consistent with SSRF that reads internal and metadata endpoints. No EPSS score, KEV entry, or POC indicator was supplied, so real-world exploitation frequency cannot be quantified from this data; the score is driven by impact and ease rather than confirmed activity. The genuine concern is the metadata-endpoint angle: in cloud deployments SSRF that reaches 169.254.169.254 can yield credentials, so a mid-sized operator running mcp-grafana in a cloud VPC should treat this as urgent regardless of the absence of KEV listing. The PR:L requirement is the main mitigating factor-this is not unauthenticated-but MCP servers often trust their callers broadly, so the privilege bar may be low in practice.

An attacker who can invoke the MCP server's tools sets X-Grafana-URL to http://169.254.169.254 and calls grafana_api_request with a GET to the cloud metadata path, then reads the returned response-harvesting instance credentials or internal service data reachable only from the server's network. The same primitive maps internal-only admin panels and databases by pointing at loopback and RFC1918 addresses. No public POC was provided, but the low complexity (AC:L) and no-interaction requirement make weaponization straightforward for anyone with tool access.