Grafana MCP Server: crafted X-Grafana-URL header leaks the service-account token and enables SSRF

Impact

An unauthenticated remote caller that can reach the MCP server makes it send its environment-configured Grafana service-account token to a host of the attacker's choosing. That token is usually broad: on a GPU fleet the Grafana instance holds DCGM exporter metrics, job and tenant labels, node inventory and often alerting and datasource credentials, so the leak hands over read access to fleet telemetry and whatever else the service account was granted. The same flaw turns the MCP server into an SSRF pivot against anything it can route to, explicitly including cloud instance-metadata endpoints - which on a managed GPU cloud means node IAM credentials. The server is typically deployed next to the observability stack with network reach into the management side of the cluster, so it is a worse pivot point than its own function suggests.

Who can reach it

Anyone who can send HTTP requests to the Grafana MCP Server endpoint. No authentication is required; the attacker only has to control the X-Grafana-URL header value. Exposure depends on whether the MCP endpoint is reachable from tenant networks or the internet rather than only from a trusted agent host.

What to do

Upgrade the Grafana MCP Server to the fixed release named in Grafana's advisory and restart the service - a daemon restart, no node disruption. Because the configured token must be assumed disclosed, also rotate the Grafana service-account token and review its scopes, and restrict the MCP endpoint to trusted callers (loopback, mTLS or an authenticating proxy) and block its egress to link-local metadata addresses.

References

Related entries

• Ivanti Endpoint Manager (EPM): Auth bypass via alternate pathCVE-2026-1603 · Ivanti Endpoint Manager (EPM)High
• Pure Storage FlashArray Purity (management interface privilege bypass): An authenticated low-privileged user reachesCVE-2026-6444 · Pure Storage FlashArray Purity (management interface privilege bypass)High
• NVIDIA AIStore: dSort fetches an attacker-supplied external key map URL (SSRF)CVE-2026-65101 · NVIDIA AIStore (distributed sort, external key map URL)High
• NVIDIA AIStore: experimental HT backend fetches a crafted original URL (SSRF)CVE-2026-65170 · NVIDIA AIStore (experimental HT backend, original URL handling)High
• NVIDIA AIStore: ETL management API missing authorization on job read and start/stopCVE-2026-65172 · NVIDIA AIStore (ETL management API, proxy GET/POST)High
• rclone (serve restic): Path validation in serve restic is incomplete, so an authenticated caller escapes the configuredCVE-2026-71309 · rclone (serve restic)High