PipeRoll - Agent Incident Registry ·
about ·
contribute ·
data ·
notes ·
constitution ·
seismograph ↗
Grafana MCP server SSRF (CVE-2026-19516): a caller-controlled URL header lets an agent…
PIR-2026-0056PIR-2026-0056id: PIR-2026-0056title: An SSRF in the Grafana MCP server (mcp-grafana) - the grafana_api_request tool honours a caller-supplied X-Grafana-URL header without restricting the destination, letting a caller aim the server's outbound requests at internal, loopback and link-local services including cloud-metadata endpoints and read the responses; a follow-on to an incomplete prior fix (CVE-2026-15583)date_occurred: not applicable - vulnerability disclosure (no confirmed in-the-wild exploitation of this CVE)date_detected: coordinated disclosure to Grafana; no individual discoverer is publicly credited in the GHSA or the Grafana advisorydate_disclosed: 2026-08-11 (GHSA-fr94-7cqc-vjrq and the Grafana security advisory published 2026-08-11)status: corroborated (CVE record, GitHub Security Advisory GHSA-fr94-7cqc-vjrq, and Grafana's own security advisory all read on 2026-09-02; product, mechanism, CWE, CVSS, disclosure date and fixed version confirmed)agent_description: mcp-grafana, the Grafana MCP (Model Context Protocol) server - the tool layer that lets an AI agent query and act on a Grafana instance. Its grafana_api_request tool proxies HTTP requests to Grafana on the agent's behalf; the destination is taken from a caller-supplied X-Grafana-URL header, and the caller also chooses the method, path and body.operator_type: unknown (affects any deployment running an affected mcp-grafana version; the vulnerability is in the tool, not in one operator's configuration)autonomy_level: human-on-the-loop (MCP servers are typically driven by an agent under some human supervision; not specific to this vuln)model_stack: not applicable (model-agnostic - the flaw is in the MCP server, reachable by whatever agent or caller drives it)harness: mcp-grafana (Grafana MCP server), affected versions <= 1.0.x; fixed in 1.1.0authority_scope: external comms + code execution context (the tool issues arbitrary outbound HTTP requests) reaching internal/loopback/link-local network services and cloud-metadata endpoints; via metadata, potential capture of instance IAM credentialsfunds_at_risk_usd: unknownblast_radius: one org per deployment, with a path to customers/third parties if harvested cloud credentials enable lateral movement (potential, not realized in a disclosed vulnerability)root_cause: plain-error (a design/input-validation flaw: the tool does not restrict the request destination to the configured Grafana instance, so a caller controls where the server's outbound requests go - classic SSRF, CWE-918; no adversary in the disclosed vulnerability). A prior fix for CVE-2026-15583 stopped the service-account token from being sent to unintended destinations but did not restrict the destinations themselves, leaving this SSRF open.failure_locus: tool-mcp (the vulnerability is in the MCP server / agent tool, not in the model's reasoning)exploitation_status: researcher-demonstrated (assigned a CVE and publicly described; no confirmed in-the-wild exploitation tied to this identifier)mechanism: The grafana_api_request tool builds an outbound HTTP request whose destination comes from a caller-supplied X-Grafana-URL header, with the method, path and body also caller-chosen. Because the destination is not constrained to the configured Grafana instance, a caller can direct the server to request internal, loopback and link-local addresses - including cloud instance-metadata service endpoints - and read the responses back. On a cloud host this exposes the instance's temporary IAM credentials, which an attacker could then use for lateral movement. CWE-918, CVSS v3.1 base score 9.1 (critical). This is the second SSRF-class issue in the same server: CVE-2026-15583 was fixed by preventing the service-account token from leaking to unintended destinations, but did not restrict the destinations, so the SSRF primitive remained until CVE-2026-19516.adversary_present: no (disclosed vulnerability; no in-the-wild adversary tied to this CVE)severity: near-miss (full exposure - an SSRF primitive that reaches cloud-metadata credentials from an agent tool - with no realized loss reported for this CVE)direct_loss_usd: 0 (no confirmed exploitation or loss for this CVE)indirect_loss_usd: unknowndowntime: nonedata_exposure: none confirmed; the exposure is the capability - reading internal/metadata endpoint responses, including instance IAM credentials, via the agent tooldetected_by: third-party (security research / coordinated disclosure; specific reporter to verify)time_to_detect: unknowntime_to_recover: fixed in mcp-grafana 1.1.0 (published with the 2026-08-11 advisory)remediation: fixed in mcp-grafana 1.1.0 - the server now restricts the request destination rather than honouring an arbitrary caller-supplied X-Grafana-URL; operators should upgrade to >= 1.1.0structural_fix: an MCP-server-design lesson - an agent tool that proxies requests must pin or allowlist its destination and must not let a caller redirect it to internal or metadata endpoints; SSRF hardening is a first-class requirement for any MCP server that makes outbound requestscontrols_that_worked: none identified (the prior CVE-2026-15583 fix addressed token leakage but not destination control, so it did not prevent this)telemetry_grade: none (a disclosed vulnerability record, not an operated-incident with logs)sources:independence: medium - the CVE record, GHSA and Grafana's own advisory describe the same coordinated disclosure; no independent second operator, as expected for a disclosed vulnerability rather than an operated incident.related: PIR-2026-0026 (GitHub MCP toxic-agent flow), PIR-2026-0028 (Supabase MCP lethal trifecta), PIR-2026-0036 (malicious postmark-mcp package) - the MCP/tool-layer failure family. This record differs in mechanism: a straight SSRF input-validation flaw in the MCP server, not a prompt-injection or supply-chain compromise.aiid_incident_id: unknown (none located as of 2026-09-02)confidence: high on the vulnerability's identity, mechanism, CWE, CVSS, disclosure date (2026-08-11) and fixed version (mcp-grafana 1.1.0), all from the GHSA and Grafana's own advisory; the reporter/discoverer is not publicly credited (recorded as such, not as unknown-pending)