{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-19516",
    "name": "CVE-2026-19516",
    "vendor": "mcp-grafana",
    "description": "Pillar Security published on 2 September 2026 two chained flaws in mcp-grafana, Grafana's official Model Context Protocol server (~1.9M cumulative Docker Hub downloads). Pre-1.1.0 releases treated a locally crafted Mcp-Session-Id that merely matched the expected format as enough to list and call tools, so a reachable caller who never authenticated could invoke grafana_api_request under the server's own Grafana service-account token. Separately, CVE-2026-19516 (CVSS 9.1, published 11 August 2026) let that same tool accept a caller-supplied X-Grafana-URL and forward arbitrary method, path, body and headers to any destination from the server's network position — including internal services and cloud metadata — returning the response to the caller. Grafana had already stopped forwarding the service-account token to foreign hosts (CVE-2026-15583), but the destination itself was unrestricted, so Pillar chained the pair into an IMDSv2-style credential retrieval in a controlled demo. Grafana released mcp-grafana v1.1.0 on 10 August 2026 with optional bearer-token auth for SSE and streamable-HTTP transports; when configured, unauthenticated requests get HTTP 401 before any tool runs.",
    "website": "https://www.pillar.security/blog/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "mcp-grafana",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-09-02",
    "risk": {
      "score": 91,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-19516",
      "aliases": [
        "ti-098"
      ],
      "title": "Grafana MCP: A Fake Session ID Plus CVE-2026-19516 SSRF Turns the Server Into an Unauthenticated Cloud Pivot (CVSS 9.1)",
      "summary": "Pillar Security published on 2 September 2026 two chained flaws in mcp-grafana, Grafana's official Model Context Protocol server (~1.9M cumulative Docker Hub downloads). Pre-1.1.0 releases treated a locally crafted Mcp-Session-Id that merely matched the expected format as enough to list and call tools, so a reachable caller who never authenticated could invoke grafana_api_request under the server's own Grafana service-account token. Separately, CVE-2026-19516 (CVSS 9.1, published 11 August 2026) let that same tool accept a caller-supplied X-Grafana-URL and forward arbitrary method, path, body and headers to any destination from the server's network position — including internal services and cloud metadata — returning the response to the caller. Grafana had already stopped forwarding the service-account token to foreign hosts (CVE-2026-15583), but the destination itself was unrestricted, so Pillar chained the pair into an IMDSv2-style credential retrieval in a controlled demo. Grafana released mcp-grafana v1.1.0 on 10 August 2026 with optional bearer-token auth for SSE and streamable-HTTP transports; when configured, unauthenticated requests get HTTP 401 before any tool runs.",
      "severity": "critical",
      "cvss": {
        "score": 9.1,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft",
        "Authentication bypass",
        "Server-side request forgery"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "mcp-grafana",
        "vendor": null,
        "package": "mcp-grafana",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<1.1.0",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-02",
      "modifiedAt": "2026-09-02",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.pillar.security/blog/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19516"
        }
      ],
      "mitigation": "Upgrade to mcp-grafana 1.1.0 or later and set MCP_GRAFANA_SERVER_TOKEN so every SSE/streamable-HTTP caller must present a bearer token; unauthenticated requests should 401 before any tool executes. Inventory every MCP server you run — not only Grafana's — and confirm inbound auth is independent of session-ID format checks, because that conflation is the recurring pattern. For any tool that accepts a caller-supplied URL, host or destination (as grafana_api_request did via X-Grafana-URL), enforce an allowlist of approved origins, resolve hostnames before applying the restriction, and block loopback, private, link-local and cloud-metadata ranges by default. Scope the Grafana service account to the minimum permissions the enabled tools need, and treat a period when an unauthenticated remote MCP was reachable as a credential-rotation event for anything that account could read.",
      "detectedByAnomity": true
    }
  }
}