# CVE-2026-19516: Grafana MCP: A Fake Session ID Plus CVE-2026-19516 SSRF Turns the Server Into an Unauthenticated Cloud Pivot (CVSS 9.1)

> CVE-2026-19516 is a critical-severity credential theft issue (CVSS 9.1) in mcp-grafana, a MCP server. Affected: <1.1.0.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-19516
- **Aliases:** ti-098
- **Severity:** critical
- **CVSS:** 9.1
- **Attack type:** Credential theft, Authentication bypass, Server-side request forgery
- **Component:** mcp-grafana (MCP server)
- **Package:** mcp-grafana
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-09-02
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-19516

## Summary

Pillar Security published on 2 September 2026 two chained flaws in mcp-grafana, Grafana's official Model Context Protocol server (~1.9M cumulative Docker Hub downloads). Pre-1.1.0 releases treated a locally crafted Mcp-Session-Id that merely matched the expected format as enough to list and call tools, so a reachable caller who never authenticated could invoke grafana_api_request under the server's own Grafana service-account token. Separately, CVE-2026-19516 (CVSS 9.1, published 11 August 2026) let that same tool accept a caller-supplied X-Grafana-URL and forward arbitrary method, path, body and headers to any destination from the server's network position — including internal services and cloud metadata — returning the response to the caller. Grafana had already stopped forwarding the service-account token to foreign hosts (CVE-2026-15583), but the destination itself was unrestricted, so Pillar chained the pair into an IMDSv2-style credential retrieval in a controlled demo. Grafana released mcp-grafana v1.1.0 on 10 August 2026 with optional bearer-token auth for SSE and streamable-HTTP transports; when configured, unauthenticated requests get HTTP 401 before any tool runs.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| <1.1.0 | no fixed version listed |

## Am I affected by CVE-2026-19516?

You are affected if you run mcp-grafana <1.1.0.

## How do I fix CVE-2026-19516?

Upgrade to mcp-grafana 1.1.0 or later and set MCP_GRAFANA_SERVER_TOKEN so every SSE/streamable-HTTP caller must present a bearer token; unauthenticated requests should 401 before any tool executes. Inventory every MCP server you run — not only Grafana's — and confirm inbound auth is independent of session-ID format checks, because that conflation is the recurring pattern. For any tool that accepts a caller-supplied URL, host or destination (as grafana_api_request did via X-Grafana-URL), enforce an allowlist of approved origins, resolve hostnames before applying the restriction, and block loopback, private, link-local and cloud-metadata ranges by default. Scope the Grafana service account to the minimum permissions the enabled tools need, and treat a period when an unauthenticated remote MCP was reachable as a credential-rotation event for anything that account could read.

## How do I find every machine running mcp-grafana?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run mcp-grafana and which version, then enforce a policy on it.

## References

- article: https://www.pillar.security/blog/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-19516

## Related vulnerabilities

- [GHSA-53mr-w429-c597](https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597) — high
- [CVE-2026-103091](https://catalog.anomity.ai/vuln/cve-2026-103091) — critical
- [CVE-2026-15643](https://catalog.anomity.ai/vuln/cve-2026-15643) — medium
- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [GHSA-7xgj-8392-5q4r](https://catalog.anomity.ai/vuln/ghsa-7xgj-8392-5q4r) — medium
- [CVE-2026-111079](https://catalog.anomity.ai/vuln/cve-2026-111079) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-19516