Grafana MCP: A Fake Session ID Plus CVE-2026-19516 SSRF Turns the Server Into an Unauthenticated Cloud Pivot (CVSS 9.1)

Pillar Security published on 2 September 2026 two chained flaws in mcp-grafana, Grafana's official Model Context Protocol server (~1.9M cumulative Docker Hub downloads). Pre-1.1.0 releases treated a locally crafted Mcp-Session-Id that merely matched the expected format as enough to list and call tools, so a reachable caller who never authenticated could invoke grafana_api_request under the server's own Grafana service-account token. Separately, CVE-2026-19516 (CVSS 9.1, published 11 August 2026) let that same tool accept a caller-supplied X-Grafana-URL and forward arbitrary method, path, body and headers to any destination from the server's network position — including internal services and cloud metadata — returning the response to the caller. Grafana had already stopped forwarding the service-account token to foreign hosts (CVE-2026-15583), but the destination itself was unrestricted, so Pillar chained the pair into an IMDSv2-style credential retrieval in a controlled demo. Grafana released mcp-grafana v1.1.0 on 10 August 2026 with optional bearer-token auth for SSE and streamable-HTTP transports; when configured, unauthenticated requests get HTTP 401 before any tool runs.

You are affected if you run mcp-grafana <1.1.0.

Upgrade to mcp-grafana 1.1.0 or later and set MCP_GRAFANA_SERVER_TOKEN so every SSE/streamable-HTTP caller must present a bearer token; unauthenticated requests should 401 before any tool executes. Inventory every MCP server you run — not only Grafana's — and confirm inbound auth is independent of session-ID format checks, because that conflation is the recurring pattern. For any tool that accepts a caller-supplied URL, host or destination (as grafana_api_request did via X-Grafana-URL), enforce an allowlist of approved origins, resolve hostnames before applying the restriction, and block loopback, private, link-local and cloud-metadata ranges by default. Scope the Grafana service account to the minimum permissions the enabled tools need, and treat a period when an unauthenticated remote MCP was reachable as a credential-rotation event for anything that account could read.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run mcp-grafana and which version, then enforce a policy on it.