# PIR-2026-0056 - Grafana MCP server SSRF (CVE-2026-19516): a caller-controlled URL header lets an agent tool proxy into internal networks and cloud-metadata endpoints and read the responses

- `id`: PIR-2026-0056
- `title`: An SSRF in the Grafana MCP server (mcp-grafana) - the grafana_api_request tool honours a caller-supplied X-Grafana-URL header without restricting the destination, letting a caller aim the server's outbound requests at internal, loopback and link-local services including cloud-metadata endpoints and read the responses; a follow-on to an incomplete prior fix (CVE-2026-15583)
- `date_occurred`: not applicable - vulnerability disclosure (no confirmed in-the-wild exploitation of this CVE)
- `date_detected`: coordinated disclosure to Grafana; no individual discoverer is publicly credited in the GHSA or the Grafana advisory
- `date_disclosed`: 2026-08-11 (GHSA-fr94-7cqc-vjrq and the Grafana security advisory published 2026-08-11)
- `status`: corroborated (CVE record, GitHub Security Advisory GHSA-fr94-7cqc-vjrq, and Grafana's own security advisory all read on 2026-09-02; product, mechanism, CWE, CVSS, disclosure date and fixed version confirmed)

### The agent
- `agent_description`: mcp-grafana, the Grafana MCP (Model Context Protocol) server - the tool layer that lets an AI agent query and act on a Grafana instance. Its grafana_api_request tool proxies HTTP requests to Grafana on the agent's behalf; the destination is taken from a caller-supplied X-Grafana-URL header, and the caller also chooses the method, path and body.
- `operator_type`: unknown (affects any deployment running an affected mcp-grafana version; the vulnerability is in the tool, not in one operator's configuration)
- `autonomy_level`: human-on-the-loop (MCP servers are typically driven by an agent under some human supervision; not specific to this vuln)
- `model_stack`: not applicable (model-agnostic - the flaw is in the MCP server, reachable by whatever agent or caller drives it)
- `harness`: mcp-grafana (Grafana MCP server), affected versions <= 1.0.x; fixed in 1.1.0

### Authority
- `authority_scope`: external comms + code execution context (the tool issues arbitrary outbound HTTP requests) reaching internal/loopback/link-local network services and cloud-metadata endpoints; via metadata, potential capture of instance IAM credentials
- `funds_at_risk_usd`: unknown
- `blast_radius`: one org per deployment, with a path to customers/third parties if harvested cloud credentials enable lateral movement (potential, not realized in a disclosed vulnerability)

### The failure
- `root_cause`: plain-error (a design/input-validation flaw: the tool does not restrict the request destination to the configured Grafana instance, so a caller controls where the server's outbound requests go - classic SSRF, CWE-918; no adversary in the disclosed vulnerability). A prior fix for CVE-2026-15583 stopped the service-account token from being sent to unintended destinations but did not restrict the destinations themselves, leaving this SSRF open.
- `failure_locus`: tool-mcp (the vulnerability is in the MCP server / agent tool, not in the model's reasoning)
- `exploitation_status`: researcher-demonstrated (assigned a CVE and publicly described; no confirmed in-the-wild exploitation tied to this identifier)
- `mechanism`: The grafana_api_request tool builds an outbound HTTP request whose destination comes from a caller-supplied X-Grafana-URL header, with the method, path and body also caller-chosen. Because the destination is not constrained to the configured Grafana instance, a caller can direct the server to request internal, loopback and link-local addresses - including cloud instance-metadata service endpoints - and read the responses back. On a cloud host this exposes the instance's temporary IAM credentials, which an attacker could then use for lateral movement. CWE-918, CVSS v3.1 base score 9.1 (critical). This is the second SSRF-class issue in the same server: CVE-2026-15583 was fixed by preventing the service-account token from leaking to unintended destinations, but did not restrict the destinations, so the SSRF primitive remained until CVE-2026-19516.
- `adversary_present`: no (disclosed vulnerability; no in-the-wild adversary tied to this CVE)

### Impact
- `severity`: near-miss (full exposure - an SSRF primitive that reaches cloud-metadata credentials from an agent tool - with no realized loss reported for this CVE)
- `direct_loss_usd`: 0 (no confirmed exploitation or loss for this CVE)
- `indirect_loss_usd`: unknown
- `downtime`: none
- `data_exposure`: none confirmed; the exposure is the capability - reading internal/metadata endpoint responses, including instance IAM credentials, via the agent tool

### Detection and recovery
- `detected_by`: third-party (security research / coordinated disclosure; specific reporter to verify)
- `time_to_detect`: unknown
- `time_to_recover`: fixed in mcp-grafana 1.1.0 (published with the 2026-08-11 advisory)
- `remediation`: fixed in mcp-grafana 1.1.0 - the server now restricts the request destination rather than honouring an arbitrary caller-supplied X-Grafana-URL; operators should upgrade to >= 1.1.0
- `structural_fix`: an MCP-server-design lesson - an agent tool that proxies requests must pin or allowlist its destination and must not let a caller redirect it to internal or metadata endpoints; SSRF hardening is a first-class requirement for any MCP server that makes outbound requests
- `controls_that_worked`: none identified (the prior CVE-2026-15583 fix addressed token leakage but not destination control, so it did not prevent this)

### Evidence
- `telemetry_grade`: none (a disclosed vulnerability record, not an operated-incident with logs)
- `sources`:
  - https://www.cve.org/CVERecord?id=CVE-2026-19516 (MITRE CVE record; product = Grafana MCP Server / mcp-grafana <= 1.0.0, CWE-918, CVSS 9.1, description of the X-Grafana-URL / grafana_api_request SSRF; fetched via the MITRE CVE API 2026-09-02)
  - https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-19516 (CVSS 9.1, CWE-918, and the relationship to the incomplete prior fix CVE-2026-15583; read 2026-09-02)
  - https://github.com/advisories/GHSA-fr94-7cqc-vjrq (GitHub Security Advisory, published 2026-08-11; CVE-2026-19516, CWE-918, CVSS 9.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, no discoverer credited; confirmed via the GitHub advisory API 2026-09-02)
  - https://grafana.com/security/security-advisories/cve-2026-19516 (Grafana's own security advisory, 2026-08-11; fixed in mcp-grafana 1.1.0, remediation = upgrade to >= 1.1.0; read 2026-09-02)
  - https://radar.offseq.com/threat/cve-2026-19516-cwe-918-in-grafana-grafana-mcp-server-3995ac1dff45c6f5 (confirms product = Grafana MCP Server, CWE-918; read via search 2026-09-02)
  - `independence`: medium - the CVE record, GHSA and Grafana's own advisory describe the same coordinated disclosure; no independent second operator, as expected for a disclosed vulnerability rather than an operated incident.
- `related`: PIR-2026-0026 (GitHub MCP toxic-agent flow), PIR-2026-0028 (Supabase MCP lethal trifecta), PIR-2026-0036 (malicious postmark-mcp package) - the MCP/tool-layer failure family. This record differs in mechanism: a straight SSRF input-validation flaw in the MCP server, not a prompt-injection or supply-chain compromise.
- `aiid_incident_id`: unknown (none located as of 2026-09-02)
- `confidence`: high on the vulnerability's identity, mechanism, CWE, CVSS, disclosure date (2026-08-11) and fixed version (mcp-grafana 1.1.0), all from the GHSA and Grafana's own advisory; the reporter/discoverer is not publicly credited (recorded as such, not as unknown-pending)

### Verification notes
- 2026-09-02: confirmed against GitHub Security Advisory GHSA-fr94-7cqc-vjrq and Grafana's security advisory (both 2026-08-11). Disclosure date is 2026-08-11 - the Vulmon aggregator's "2026-11-08" is a mis-date and was not used. Fixed in mcp-grafana 1.1.0. No individual discoverer is credited in either primary. Status flipped draft -> corroborated on that basis.
- DO NOT CONFLATE with the classic Grafana SSRF: Fortinet's reporting on "AWS credential compromises tied to Grafana SSRF attacks" concerns CVE-2020-13379 (the Grafana 3.0.1-6.7.4 / 7.0.0-7.0.2 data-source-proxy SSRF), a different, older vulnerability with confirmed in-the-wild AWS-metadata credential theft. That in-the-wild activity is NOT tied to CVE-2026-19516 and must not be attributed to this MCP-server record.
- Schema note (feed back into v0): root_cause has no clean token for an implementation/design vulnerability in a tool (SSRF-class). This record uses plain-error with the SSRF/CWE-918 detail in prose; failure_locus=tool-mcp carries the real signal. If tool/dependency vulnerabilities recur (they do - see the MCP family), a dedicated root_cause token may be warranted.