Database/Control plane, storage & DevOps
Grafana MCP Server: caller-controlled X-Grafana-URL header turns grafana_api_request into a full SSRF primitive
Impact
The destination of the MCP server's outbound requests comes from a caller-supplied X-Grafana-URL header and is not constrained to the configured Grafana instance, while the grafana_api_request tool already lets the caller pick method, path and body. A caller can therefore make the server issue arbitrary requests to internal, loopback and link-local addresses - including cloud instance-metadata endpoints - and read the responses back. An MCP server sits inside the cluster by design, so this is a read primitive against everything the observability namespace can reach: internal admin APIs, unauthenticated node and scheduler endpoints, and metadata-service credentials. The record notes the earlier fix for CVE-2026-15583 only stopped the service-account token from leaking to unintended destinations; the destinations themselves stayed unrestricted.
Who can reach it
Any caller that can reach the MCP server's HTTP interface and set request headers. The CVSS vector records low privileges required, so an authenticated-but-unprivileged consumer of the MCP endpoint - including an LLM agent steered by prompt content - is enough.
What to do
Update mcp-grafana to the fixed release named in the Grafana advisory for CVE-2026-19516; the record does not carry a version number, so take it from the advisory. Rolling the MCP server is a container image bump and process restart, not a node drain. Until then, keep the MCP endpoint off any network path reachable by untrusted callers, and apply egress network policy to its pod so loopback, link-local (169.254.169.254) and internal control-plane addresses are unreachable from it.
References
Related entries
- Apache CloudStack Proxmox extension (cross-tenant instance access): The extension keys CloudStack instances to ProxmoxCVE-2026-25199 · Apache CloudStack Proxmox extension (cross-tenant instance access)Critical
- BACnet Stack open-source C library (bacnet-stack) embedded in third-party controllers and gateways: A runCVE-2026-41475 · BACnet Stack open-source C library (bacnet-stack) embedded in third-party controllers and gatewaysCritical
- Ceph Monitor: any read-only CephX user can dump the config-key store, including cephadm's cluster-wide SSH keyCVE-2026-50152 · Ceph Monitor (MMonSubscribe config-key store authorization)Critical
- AMD EPYC / Ryzen - Hardware Validated Boot enforcement: Hardware Validated Boot is not properly enforced, so anCVE-2018-8930 · AMD EPYC / Ryzen - Hardware Validated Boot enforcementCritical
- AMD EPYC Server - protected memory region access control: Insufficient access control over protected memory regions onCVE-2018-8933 · AMD EPYC Server - protected memory region access controlCritical
- PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigation: Non-uniform Rowhammer patterns triggered bit flips on every oneCVE-2021-42114 · PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigationCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.