GO-2026-4514 vulnerabilities

Vulnerabilities for packages: eksctl, k3s, datadog-agent, nfpm, weaviate, nuclei, cri-tools, goreleaser, witness, opentelemetry-collector-contrib, grafana, terragrunt, grafana-alloy, prometheus, k8sgpt, gitlab-runner, dgraph, tempo, opentelemetry-collector, rclone, lazygit, kubevela, teleport,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: minio-operator, prometheus-pushgateway, datadog-agent, keda, trillian, certificate-transparency, minio-object-browser, splunk-otel-collector, aws-otel-collector, grafana-pyroscope, mc, cloud-sql-proxy, telegraf, jaeger, tempo, istio, karma, mcp-grafana, loki, minio...

CVE-2026-19516

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516

The CVE describes SSRF in Grafana’s mcp-grafana outbound requests: a caller-supplied X-Grafana-URL header plus grafana_api_request can set HTTP method, path, and body, enabling directing requests to internal, loopback, and link-local services (including metadata endpoints) beyond the configured G...

EUVD-2026-55938

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

PT-2026-70062

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana api request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can dire...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: minio-operator, prometheus-pushgateway, datadog-agent, node-problem-detector, opentelemetry-collector-contrib, opentelemetry-operator, keda, trillian, certificate-transparency, minio-object-browser, splunk-otel-collector, aws-otel-collector, mc, cloud-sql-proxy,...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: karma-fips, agentbeat, opentelemetry-collector, loki-fips, nrdot-collector-k8s, prometheus-pushgateway-fips, elastic-agent, jaeger, datadog-agent-fips, certificate-transparency-fips, mcp-grafana, trillian-fips, minio, aws-otel-collector, minio-object-browser-fips,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: eksctl, k3s, datadog-agent, nfpm, weaviate, nuclei, cri-tools, goreleaser, witness, opentelemetry-collector-contrib, grafana, terragrunt, grafana-alloy, prometheus, k8sgpt, gitlab-runner, dgraph, tempo, opentelemetry-collector, rclone, lazygit, kubevela, teleport,...