CVE-2026-19516Disclosure

MEDIUMCVSS 9.1 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

Back to dashboard

5.8/ 10 priority

Sources & remediation

Other references

https://grafana.com/security/security-advisories/cve-2026-19516

Weakness type (CWE)

CWE-918

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
16 mentions across 12 observed days

What's happening

Active exploitation reported across 2 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 8 signals
Technical details provided in 13 signals
Disclosure: 6 classified signals
Peaked 11d ago at 3 mentions (2026-08-11); latest day: 1
16 total mentions across 12 days

Deep dive

Activity timeline16 mentions / 12d

Signal classification4 categories

Disclosure

642.9%

Patch

535.7%

Active Exploitation

214.3%

General

17.1%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-11	3	Disclosure2General1
2026-08-12	1	Patch1
2026-09-02	1	Disclosure1
2026-09-03	1	Active Exploitation1
2026-09-04	3	Disclosure1Patch2
2026-09-05	1	Patch1
2026-09-06	1	Disclosure1
2026-09-07	1	Patch1
2026-09-08	1	Active Exploitation1
2026-09-11	1	Disclosure1

Full discourse16 posts

VIEH Group@viehgroup14d
Disclosure
Grafana MCP -> Auth Bypass + SSRF -> Cloud Credential Theft Attack Path -> 1. Abuse the MCP server's session identifier as if it were an authentication credential. 2. Reach the grafana_api_request tool without valid authentication. 3. Use the SSRF flaw (CVE-2026-19516) to redirect the server's privileged requests to internal endpoints. 4. Researchers demonstrated the chain reaching AWS IMDSv2 and retrieving cloud credentials. Learning -> 1. A session ID is not an identity boundary. 2. MCP servers acting with backend privileges can become powerful confused deputies when authentication and outbound request controls fail. #BugBounty #AISecurity #MCP #SSRF #CloudSecurity #CyberSecurity
Post summary
The post discloses an SSRF vulnerability in Grafana MCP (CVE‑2026‑19516) and demonstrates a chain that uses session IDs to access internal endpoints and steal AWS credentials.
02073298
6.8K followersView on X
CVE@CVEnew45d
Disclosure
CVE-2026-19516 A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choo… https://www.cve.org/CVERecord?id=CVE-2026-19516
Post summary
The text outlines a header-based control flaw in mcp‑grafana that allows manipulation of outbound requests, constituting a disclosure of CVE‑2026‑19516.
01020942
58.1K followersView on X
Sagar Tanur 🇮🇳@Sagarvd015d
Grafana MCP chain worth bookmarking (Pillar): session ID that was never issued still unlocked tools, then grafana_api_request’s X-Grafana-URL turned the server into an SSRF bridge to internal + metadata (CVE-2026-19516, fixed ≥1.1.0). lesson: conversation state ≠ caller identity. don’t conflate them.
0002061
164 followersView on X
Breachrr@Breachrr20d
Patch
A session ID that matches a UUID pattern is not a session the server issued. Affected mcp-grafana releases accepted a caller-supplied Mcp-Session-Id after a format check. That was enough to list and call tools under the server's Grafana service account. CVE-2026-19516 then let the caller set X-Grafana-URL plus method, headers, and body. Pillar showed the AWS metadata path in that position: one PUT to obtain an IMDSv2 token, then a second request to pull credentials. Upgrade to mcp-grafana 1.1.0. If the host can reach 169.254.169.254, treat instance credentials as in scope until you prove otherwise.
Post summary
The CVE‑2026‑19516 vulnerability in mcp‑grafana allows an attacker to forge session IDs and craft arbitrary requests, including pulling AWS credentials; upgrading to version 1.1.0 eliminates the flaw.
10010108
31 followersView on X
Rıdvan Yağlı@ridvanyagli21d
Disclosure
🔴 Grafana'nın MCP sunucusunda kritik SSRF açığı keşfedildi! CVE-2026-19516 (CVSS 9.1), saldırganların X-Grafana-URL başlığı üzerinden MCP sunucusunun yaptığı HTTP isteklerinin hedefini, metodunu ve içeriğini kontrol etmesine izin veriyordu. Böylece Grafana MCP sunucusu, saldırgan için internette doğrudan erişilemeyen iç ağlara ve cloud metadata servislerine erişebilen bir proxy'ye dönüşebiliyordu. Araştırmacılar kontrollü PoC'de AWS IMDSv2 benzeri bir akışla metadata erişimini de gösterdi. Açıkmcp-grafana 1.1.0 sürümünde düzeltildi
Post summary
A critical SSRF vulnerability (CVE-2026-19516) was disclosed in Grafana MCP, with a PoC demonstrating exploitation of internal networks and cloud metadata, and a patch was released in openmcp-grafana 1.1.0.
00011440
2.2K followersView on X
Ryx@PadhiyarRushi18d
Patch
@FelipeFumero663 Grafana patched it in mcp-grafana 1.1.0 (CVE-2026-19516). Still live on anything older or where the new auth wasn’t turned on.
Post summary
Grafana fixed CVE‑2026‑19516 in version 1.1.0, but older releases or those without the new authentication remain vulnerable.
0001052
591 followersView on X
Christopher Elliott@Chris_L_Elliott19d
Disclosure
Grafana’s official MCP server got a CVSS 9.1 for session spoofing + SSRF (CVE-2026-19516). The part people keep missing: mcp-grafana v1.1.0 adds bearer auth, but it’s still optional. Upgrade without --server-auth-token and you’re still on the same fail-open pattern that shipped to ~1.9M Docker pulls. A format-check on mcp-session-* is not auth. Pillar/CSA nailed it. https://labs.cloudsecurityalliance.org/research/csa-research-note-grafana-mcp-ssrf-session-spoofing-20260903/
Post summary
This post highlights Grafana’s MCP server vulnerability (CVE‑2026‑19516) with a CVSS score of 9.1 for session spoofing and SSRF, noting that the optional bearer auth does not mitigate the issue and refers to a CSA research note for more details.
0001077
40 followersView on X
CloudSecurityAlliance@cloudsa22d
Active Exploitation
CISO Daily Briefing: GitSpawn hijacks AI coding agents (Claude Code, Cursor, Codex, Goose) via malicious .git/config — 4/8 variants unpatched. Grafana MCP SSRF+auth-bypass (CVE-2026-19516, CVSS 9.1) hit ~1.9M Docker pulls. GPUThor Rowhammer breaks ECC on NVIDIA RTX A-series GPUs — no patch, root in ~1min. Gov: EU CRA Art.14 hits Sept 11, 24hr exploited-vuln reporting, up to €15M/2.5% fines. Strategic: LatAm clusters use LLMs to debug exploits vs govt/finance targets. https://labs.cloudsecurityalliance.org/research/ciso-daily-briefing-20260903/
Post summary
The briefing highlights active exploitation of Grafana CVE-2026-19516 with millions of Docker pulls, unpatched GitSpawn variants affecting AI coding agents, and a zero‑day GPURowhammer that grants root in minutes.
10000541
18.9K followersView on X
Sami Laiho@samilaiho44d
Patch
Critical vulnerability in Grafana MCP Server URL: https://nvd.nist.gov/vuln/detail/CVE-2026-19516 Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1
Post summary
The post announces a critical vulnerability in Grafana MCP Server (CVE‑2026‑19516) and indicates that an official fix is available, noting its CVSS score of 9.1.
00010628
30.6K followersView on X
Upwind Security MDR@UpwindMDR45d
Disclosure
🚨Critical - Grafana MCP Server SSRF via caller-controlled X-Grafana-URL (CVE-2026-19516) mcp-grafana lets the caller set the outbound request destination through the X-Grafana-URL header, and grafana_api_request lets them pick the method, path, and body — so a low-priv caller can reach internal, loopback, and link-local services (incl. cloud metadata endpoints) and read the responses. 👉Affected: mcp-grafana < 1.1.0 Upgrade to `mcp-grafana` 1.1.0 or later.
Post summary
CVE-2026-19516 exposes an SSRF flaw in mcp‑grafana, allowing low‑priv callers to reach internal services; the vulnerability is disclosed with a clear fix in version 1.1.0.
00010151
285 followersView on X
Nik Kale@nik_kale1d
An MCP server is a proxy with a friendly name. Grafana's just shipped the proxy failure mode that every proxy eventually ships. CVE-2026-19516, CVSS 9.1, Grafana MCP before 1.1.0. The grafana_api_request tool accepted an X-Grafana-URL header from the caller, and that header controlled the method, path and body of the outbound request. Server-side request forgery from the server's own network position. Pillar Security paired it with a second weakness: unauthenticated users could produce validly formatted session IDs. Together, a chain to internal services and to cloud credentials sitting on the metadata endpoint. The pattern is decades old. A tool that makes requests on your behalf lets the caller shape the request. What is new is where the tool sits: inside the agent's trust boundary, with the agent's network access, invoked by text. Every MCP tool that talks to a network is an SSRF candidate. Pin destinations server-side. Never let a tool argument name a host. https://www.scworld.com/news/grafana-fixes-critical-ssrf-flaw-affecting-grafana-mcp-servers
0000054
409 followersView on X
CloudSecurityAlliance@cloudsa17d
Active Exploitation
CISO Daily Briefing: Attackers chain Langflow's 12 2026 CVEs for credential theft/cryptomining, 15k+ attempts. Grafana MCP SSRF (CVE-2026-19516, CVSS 9.1) leaked AWS IMDS via a confused-deputy bug — patch to v1.1.0+. Claude Code's Auto Mode falls to injection 60-80% vs. a claimed 0%. Gov: ISO 42001 certs multiply but hold no EU AI Act legal weight; EN 18286 does. Strategy: UK AISI, OpenAI & a Thailand breach show agents acting unauthorized, no jailbreak. https://labs.cloudsecurityalliance.org/research/ciso-daily-briefing-20260908/
Post summary
Attackers are actively exploiting multiple new CVEs, notably an SSRF (CVE‑2026‑19516) that leaks AWS metadata, with evidence of 15k+ attempts and a vendor patch already available.
00000333
18.9K followersView on X
NeoTeo.com@NeoteoCom21d
Patch
Grafana MCP tenía una falla SSRF (CVE-2026-19516, CVSS 9.1) que dejaba convertir el servidor en proxy hacia redes internas sin autenticación. 1,9 millones de descargas en Docker Hub, corregido en v1.1.0. https://thn.news/grafana-mcp-flaws
Post summary
Se reveló una falha SSRF (CVE‑2026‑19516, CVSS 9.1) en Grafana MCP que permitía usar el servidor como proxy interno sin autenticación, y la corrección se publicó en la versión 1.1.0.
00000173
15.9K followersView on X
AminTechs@AminTechs21d
Patch
Session IDs are protocol state, not caller identity. Grafana MCP (CVE-2026-19516) made that concrete: spoofable session plus grafana_api_request destination control became SSRF into internal/metadata paths, even when the service-account token was withheld from foreign hosts. Patch ≥1.1.0 helps; durable fix is inbound auth plus destination allowlists, not format checks on session IDs.
Post summary
This note highlights that Grafana’s CVE‑2026‑19516 can be exploited via spoofed session IDs resulting in SSRF, and that patching to version ≥1.1.0 and implementing inbound authentication with destination allowlists provides protection.
0000032
122 followersView on X
Botconduct@Botconduct23d
Disclosure
The Grafana MCP bug (CVE-2026-19516): the server validated the format of a credential, never who was presenting it — “a token they never had.” Identity is a claim. Behavior is what happened. And the record only counts if the actor can’t reach it. https://botconduct.org/research/a-token-they-never-had/
Post summary
The post outlines the Grafana MCP bug (CVE-2026-19516) where credential format is validated but identity is not checked, and references a research link that likely contains further details.
0000051
15 followersView on X
Infoflowcloud@infoflowcloud45d
General
🚨*CVE* CVE-2026-19516 A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choo… https://www.cve.org/CVERecord?id=CVE-2026-19516 ----- Traducción: CVE-2026-19516 Un … http://infoflow.cloud`
Post summary
The post references CVE-2026-19516, giving a brief technical description of an X‑Grafana‑URL header flaw in mcp‑grafana, but offers no PoC, exploit, patch, or evidence of active exploitation.
0000043
97 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-19516

VIEH Group[verified]@viehgroupDisclosure

The post discloses an SSRF vulnerability in Grafana MCP (CVE‑2026‑19516) and demonstrates a chain that uses session IDs to access internal endpoints and steal AWS credentials.

Breachrr[verified]@BreachrrPatch

The CVE‑2026‑19516 vulnerability in mcp‑grafana allows an attacker to forge session IDs and craft arbitrary requests, including pulling AWS credentials; upgrading to version 1.1.0 eliminates the flaw.

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

A critical SSRF vulnerability (CVE-2026-19516) was disclosed in Grafana MCP, with a PoC demonstrating exploitation of internal networks and cloud metadata, and a patch was released in openmcp-grafana 1.1.0.

Ryx[verified]@PadhiyarRushiPatch

Grafana fixed CVE‑2026‑19516 in version 1.1.0, but older releases or those without the new authentication remain vulnerable.

Christopher Elliott[verified]@Chris_L_ElliottDisclosure

This post highlights Grafana’s MCP server vulnerability (CVE‑2026‑19516) with a CVSS score of 9.1 for session spoofing and SSRF, noting that the optional bearer auth does not mitigate the issue and refers to a CSA research note for more details.

CloudSecurityAlliance[verified]@cloudsaActive Exploitation

The briefing highlights active exploitation of Grafana CVE-2026-19516 with millions of Docker pulls, unpatched GitSpawn variants affecting AI coding agents, and a zero‑day GPURowhammer that grants root in minutes.

Sami Laiho[verified]@samilaihoPatch

The post announces a critical vulnerability in Grafana MCP Server (CVE‑2026‑19516) and indicates that an official fix is available, noting its CVSS score of 9.1.

Upwind Security MDR[verified]@UpwindMDRDisclosure

CVE-2026-19516 exposes an SSRF flaw in mcp‑grafana, allowing low‑priv callers to reach internal services; the vulnerability is disclosed with a clear fix in version 1.1.0.