Grafana MCP Server vulnerabilities

2 known vulnerabilities in Grafana MCP Server from Grafana. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Grafana MCP Server: Server-Side Request Forgery

  CVE-2026-19516Aug 11, 2026Grafana

  A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configure

• 8.6 High severity

  Grafana MCP Server: Externally Controlled Reference to a Resource in Another Sphere

  CVE-2026-15583Jul 15, 2026Grafana

  A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary