CVE-2026-19516

The CVE describes SSRF in Grafana’s mcp-grafana outbound requests: a caller-supplied X-Grafana-URL header plus grafana_api_request can set HTTP method, path, and body, enabling directing requests to internal, loopback, and link-local services (including metadata endpoints) beyond the configured G...