12 matches found
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: redpanda, mcp-grafana, goreleaser, tempo, rclone, grafana-alloy, datadog-agent, cri-tools, nfpm, terraform-mcp-server, dgraph, eksctl, witness, k8sgpt, lazygit, ollama, opentelemetry-collector, nuclei, minio, maru, loki, opentelemetry-collector-contrib, prometheus,...
GO-2026-5662 vulnerabilities
Vulnerabilities for packages: telegraf, mcp-grafana, splunk-otel-collector, tempo, istio, cloud-sql-proxy, trillian, minio-operator, datadog-agent, karma, jaeger, mc, minio-object-browser, certificate-transparency, aws-otel-collector, keda, minio, loki, prometheus-pushgateway, grafana-pyroscope...
CVE-2026-19516
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...
CVE-2026-19516
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...
CVE-2026-19516
The CVE describes SSRF in Grafana’s mcp-grafana outbound requests: a caller-supplied X-Grafana-URL header plus grafana_api_request can set HTTP method, path, and body, enabling directing requests to internal, loopback, and link-local services (including metadata endpoints) beyond the configured G...
EUVD-2026-55938
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...
CVE-2026-19516 CVE-2026-19516 CVE Record
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...
CVE-2026-19516 CVE-2026-19516 CVE Record
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...
PT-2026-70062
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana api request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can dire...
CVE-2026-44903 vulnerabilities
Vulnerabilities for packages: telegraf, mcp-grafana, splunk-otel-collector, tempo, istio, cloud-sql-proxy, trillian, minio-operator, amazon-cloudwatch-agent-operator, datadog-agent, metrics-server, karma, node-problem-detector, jaeger, k8sgpt, opentelemetry-collector, mc, minio-object-browser,...
GHSA-FW8G-CG8F-9J28 vulnerabilities
Vulnerabilities for packages: trillian-fips, datadog-agent-fips, cloudzero-agent-fips, jaeger-fips, mcp-grafana, ops-agent, agentbeat, cloudzero-agent, karma, prometheus-pushgateway-fips, telegraf, istio-fips, prometheus-fips, splunk-otel-collector, beats, nrdot-collector-k8s-fips, tempo,...
CVE-2026-32285 vulnerabilities
Vulnerabilities for packages: redpanda, mcp-grafana, goreleaser, tempo, rclone, grafana-alloy, datadog-agent, cri-tools, nfpm, terraform-mcp-server, dgraph, eksctl, witness, k8sgpt, lazygit, ollama, opentelemetry-collector, nuclei, minio, maru, loki, opentelemetry-collector-contrib, prometheus,...