Originally published at HOL

CVE-2026-19516: Grafana MCP Server SSRF Via Caller-Controlled URL Header

TL;DR: CVE-2026-19516 is a server-side request forgery vulnerability in the Grafana MCP Server. A caller can set the X-Grafana-URL header to any destination, then use the grafana_api_request tool to send arbitrary HTTP requests to internal services, loopback addresses, and cloud metadata endpoints. The response bodies are returned to the caller. There is no fix available.

What happened

The Grafana MCP Server exposes a tool called grafana_api_request that lets an MCP client make HTTP requests to a Grafana instance. The destination of those requests is controlled by the X-Grafana-URL request header. The server does not validate that this header points to a configured Grafana instance.

A caller can set X-Grafana-URL to any URL. The grafana_api_request tool also lets the caller choose the HTTP method, path, and body. Together, these inputs give a caller full control over outbound HTTP requests: destination, method, path, and payload. Responses are returned to the caller.

This is textbook server-side request forgery. The target can be an internal service on the host network, the loopback interface (127.0.0.1), or a cloud metadata endpoint like 169.254.169.254 on AWS or metadata.google.internal on GCP. The response body is returned to the MCP client, which means sensitive data from those endpoints flows back to whoever invoked the tool.

A prior fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations. That fix did not restrict the destinations themselves. The server still happily sends requests wherever the X-Grafana-URL header points.

Who is affected

The affected package is mcp-grafana from the Grafana namespace. There are no fixed versions listed. Anyone running the Grafana MCP Server and granting an MCP client access to the grafana_api_request tool is vulnerable.

The Grafana MCP Server is a Model Context Protocol server. It exposes Grafana dashboards, queries, and API operations to AI agents that support the MCP protocol. Organizations integrating AI assistants with their Grafana infrastructure use this server as the bridge. Any agent with access to the MCP server can exploit this SSRF, whether the agent's instructions are trusted or a prompt injection hijacks the request.

The blast radius depends on what the MCP server's host can reach. If it runs inside a Kubernetes cluster with access to the pod network, an attacker can scan internal services and read their responses. If it runs on a cloud instance, cloud metadata endpoints are reachable. The response data is returned to the caller through the MCP protocol, so the attacker exfiltrates the data without needing a separate channel.

What to do

There is no patched release. Mitigations:

• Remove the grafana_api_request tool from the MCP server's tool registry if your AI agents do not need it. This eliminates the request primitive.
• Network-level restrictions. Run the MCP server in a network namespace or container with egress filtering. Block outbound traffic to RFC 1918 ranges, loopback, and link-local addresses (including 169.254.169.254).
• Proxy the Grafana URL. Configure a reverse proxy in front of the actual Grafana instance and point the MCP server at the proxy. The proxy can validate and forward only requests to the intended backend.
• Audit MCP tool access. If you use HOL Guard or a similar agent security layer, block the grafana_api_request tool or add a policy that rejects requests containing an X-Grafana-URL header that does not match your configured Grafana host.

Why it matters

This vulnerability sits at a junction that AI security teams should pay attention to. MCP servers are the tool layer that AI agents call. When one of those tools has an SSRF, the attack surface is not a traditional web user. It is any prompt, instruction, or context that can influence what an agent sends to that tool.

The X-Grafana-URL header is caller-controlled. In an MCP architecture, "the caller" is the AI agent. A prompt injection in a document, email, or web page the agent reads can instruct the agent to set X-Grafana-URL to a metadata endpoint and call grafana_api_request. The returned credentials or internal service data flow back through the agent to the attacker. This is the exact pattern that makes MCP tool vulnerabilities dangerous: the tool executes faithfully, the agent follows instructions, and the data exfiltration looks like a normal tool response.

NVD enrichment is pending. The CVE was published on the hol.org feed on August 11, 2026. No CVSS score has been assigned yet.

References

• hol.org CVE feed
• NVD entry (pending)
• Grafana MCP Server: github.com/grafana/mcp-grafana
• Related: CVE-2026-15583 (prior fix for service-account token leak)