What happened
NVD published CVE-2026-19516 (CVSS 9.1, Critical) on 2026-08-11. The advisory notes the fix for a prior CVE (CVE-2026-15583) prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves, leaving the SSRF primitive intact.
Why it matters
MCP servers routinely hold long-lived credentials for the backend systems they broker access to (per this window's broader MCP data-exposure theme). This SSRF lets any MCP caller pivot the Grafana server's authenticated network position to reach internal services and cloud metadata (credential theft), a widely-deployable observability tool integrated into many enterprise AI/agent stacks.
Attack vector
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose HTTP method, path, and body. Since destinations aren't restricted to the configured Grafana instance, an attacker (any MCP tool caller) can redirect authenticated requests to internal, loopback, and link-local services including cloud metadata endpoints, reading the responses (SSRF).
Affected systems
mcp-grafana (Grafana Labs Model Context Protocol server), prior to fixed release
Mitigation
Upgrade mcp-grafana to the patched release; restrict which principals can invoke MCP tools with Grafana credentials; enforce an allowlist on outbound MCP request destinations.