What is the CVSS score of CVE-2026-19516?

CVE-2026-19516 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of mcp-grafana are affected by CVE-2026-19516?

Grafana MCP Server contains a critical vulnerability (CVE-2026-19516, CVSS 9.1) that allows authorized users to redirect API requests to access internal systems and cloud infrastructure endpoints,…

How to fix or mitigate CVE-2026-19516?

Within 24 hours: Identify all Grafana MCP Server deployments and audit which users have access to the grafana_api_request tool; review recent audit logs for suspicious X-Grafana-URL header usage. Within 7 days: Implement firewall rules on Grafana MCP Server egress to block traffic to internal networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), link-local ranges (169.254.0.0/16), and cloud metadata endpoints (169.254.169.254 and provider equivalents); disable the grafana_api_request tool if not operationally critical. Within 30 days: Subscribe to Grafana security advisories and apply vendor patch immediately upon release; restrict tool access to essential users through identity governance; conduct forensic analysis of logs for exploitation attempts and assess scope of data exposure.

mcp-grafana CVE-2026-19516

EUVD-2026-55938 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-11 GRAFANA

GHSA-fr94-7cqc-vjrq

SSRF Grafana Grafana Mcp Server Mcp Grafana

9.1

CVSS 3.1 · Vendor: GRAFANA

Severity by source

Vendor (GRAFANA) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

vuln.today AI

9.1 CRITICAL

Network-reachable via HTTP with a valid tool caller (PR:L), trivial to trigger (AC:L); SSRF reaches other systems (S:C) and reads their responses (C:H), with limited write/availability effect from arbitrary method/body (I:L/A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (GRAFANA).

CVSS VectorVendor: GRAFANA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 06:01 vuln.today

CVE Published

Aug 11, 2026 - 05:28 cve.org

CRITICAL 9.1

DescriptionCVE.org

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

Articles & Coverage 1

News Critical SSRF in Grafana MCP Server - CVE-2026-19516 Aug 11, 2026

AnalysisAI

Server-side request forgery in Grafana's mcp-grafana (Grafana MCP Server) lets an authenticated caller override the outbound request destination via the X-Grafana-URL header while using the grafana_api_request tool to control HTTP method, path, and body. Because the destination is never constrained to the configured Grafana instance, callers can pivot the server into internal, loopback, and link-local services-including cloud metadata endpoints-and read the responses. This is an incomplete-fix follow-on to CVE-2026-15583, which stopped the service-account token from leaking to unintended hosts but left the destinations themselves unrestricted; no public exploit identified at time of analysis.

Technical ContextAI

The affected component is mcp-grafana, a Model Context Protocol (MCP) server that exposes Grafana's HTTP API to MCP clients/LLM agents. The grafana_api_request tool is designed to proxy calls to the configured Grafana instance, but the target host is derived from a caller-supplied X-Grafana-URL header rather than a fixed, validated base URL. This is a textbook CWE-918 (Server-Side Request Forgery): untrusted input flows into the destination of a server-initiated request without allowlisting. Because the tool also accepts arbitrary method, path, and body, the primitive is a near-general-purpose outbound HTTP client running from the server's network position. The CPEs cpe:2.3:a:grafana:grafana_mcp_server and cpe:2.3:a:grafana:mcp-grafana identify the two naming variants of the same product.

RemediationAI

Patch available per vendor advisory-upgrade mcp-grafana to the fixed release identified in the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-19516 (exact fix version not provided in the available data; confirm against that advisory). As compensating controls until patched: disable or remove the grafana_api_request tool from the exposed MCP toolset if your workflows do not require it; strip or ignore the caller-supplied X-Grafana-URL header at a reverse proxy so the destination cannot be overridden; and enforce egress network policy so the server can only reach the intended Grafana host, explicitly blocking loopback, RFC1918, link-local (169.254.0.0/16, notably the 169.254.169.254 metadata endpoint) ranges. On cloud instances, enforce IMDSv2 (token-required metadata) to blunt metadata theft. Trade-offs: removing the tool breaks any agent workflows that legitimately call arbitrary Grafana API paths, and header stripping requires the proxy to inject the correct configured URL itself.