{"id":"CVE-2026-19516","aliases":["EUVD-2026-55938","GHSA-fr94-7cqc-vjrq"],"status":"published","title":"CVE-2026-19516 CVE Record","description":"A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0031,"percentile":0.24124,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-918"],"published":"2026-08-11T05:28:30Z","modified":"2026-08-31T18:50:00Z","exploits":[{"source":"pocgithub","id":"HORKimhab/CVE-2026-19516","title":"HORKimhab/CVE-2026-19516","date":"2026-09-04","url":"https://github.com/HORKimhab/CVE-2026-19516"}],"products":[{"vendor":"grafana","product":"grafana mcp server"},{"vendor":"grafana","product":"mcp-grafana"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-19516","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19516"},{"url":"https://github.com/advisories/GHSA-fr94-7cqc-vjrq"}],"sources":{"cve":[{"id":"CVE-2026-19516","title":"CVE-2026-19516 CVE Record","description":"A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.","status":"published","published":"2026-08-11T05:28:30.662Z","modified":"2026-08-27T17:22:24.258Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-55938","description":"A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.","status":"published","published":"2026-08-11T05:28:30Z","modified":"2026-08-27T17:22:24Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-fr94-7cqc-vjrq","title":"A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound...","description":"A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.","status":"published","published":"2026-08-11T06:31:19Z","modified":"2026-08-11T06:31:25Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:10:17.025827Z"}],"nvd":[{"id":"CVE-2026-19516","description":"A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.","status":"published","published":"2026-08-11T06:17:13.433Z","modified":"2026-08-31T18:50:00.053Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:36.102748Z"}]}}