Executive brief
Grafana MCP is a tool that allows integration with Grafana instances for monitoring and observability tasks. An attacker with access to invoke the grafana_api_request tool can exploit a header validation flaw to redirect requests to internal network services, metadata endpoints, and loopback addresses, potentially exposing sensitive configuration data and enabling reconnaissance of the internal infrastructure.
Technical details
This is a server-side request forgery (SSRF) vulnerability in Grafana MCP's grafana_api_request tool. The vulnerability exists because the tool accepts a caller-supplied X-Grafana-URL request header that controls the destination of outbound requests without validating that the destination is the configured Grafana instance. An authenticated caller can supply an arbitrary X-Grafana-URL header value along with chosen HTTP method, path, and request body to make the MCP server issue requests to internal, loopback, or link-local services. A prior fix for CVE-2026-15583 prevented the service-account token from being leaked to unintended destinations but did not restrict the destination URLs themselves. The vulnerability requires authentication (PR:L) and allows an attacker to read responses from internal services. Fixed in version 1.1.0 and later.
Affected products
- Grafana MCP <1.1.0
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Fixed in version 1.1.0