GO-2026-4514 vulnerabilities

Vulnerabilities for packages: terragrunt, malcontent, minio, ollama, rclone, tempo, prometheus, kubevela, dagger, datadog-agent, maru, terraform-mcp-server, goreleaser, mcp-grafana, k8sgpt, loki, nuclei, nfpm, weaviate, gitlab-runner, witness, k3s, teleport, redpanda, lazygit,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: minio, grafana-pyroscope, tempo, trillian, jaeger, datadog-agent, minio-operator, mcp-grafana, aws-otel-collector, mc, loki, prometheus-pushgateway, cloud-sql-proxy, istio, minio-object-browser, telegraf, splunk-otel-collector, keda, certificate-transparency, karma...

CVE-2026-19516

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

EUVD-2026-55938

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516

The CVE describes SSRF in Grafana’s mcp-grafana outbound requests: a caller-supplied X-Grafana-URL header plus grafana_api_request can set HTTP method, path, and body, enabling directing requests to internal, loopback, and link-local services (including metadata endpoints) beyond the configured G...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

PT-2026-70062

Name of the Vulnerable Software and Affected Versions mcp-grafana versions prior to 1.1.0 Description An authentication bypass allows unauthenticated attackers to use self-generated session IDs to gain access to the server's Grafana service account. This can be chained with a server-side request...

CVE-2026-19516: Server-Side Request Forgery (SSRF)

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-15583

A vulnerability has been discovered in the mcp-grafana project https://github.com/grafana/mcp-grafana where a confused-deputy flaw allows an unauthenticated remote attacker to exfiltrate the server’s environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: minio, tempo, trillian, jaeger, node-problem-detector, amazon-cloudwatch-agent-operator, datadog-agent, opentelemetry-operator, minio-operator, mcp-grafana, aws-otel-collector, k8sgpt, loki, mc, prometheus-pushgateway, cloud-sql-proxy, fluent-bit-plugin-loki, istio,...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: telegraf, grafana-fips, minio, nrdot-collector-k8s, jaeger-fips, keda-fips, opentelemetry-collector, trillian-fips, karma-fips, karma, mc-fips, agentbeat, minio-fips, keda, nrdot-collector-k8s-fips, fluent-bit-plugin-loki, beats-fips, beats, grafana,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: terragrunt, malcontent, minio, ollama, rclone, tempo, prometheus, kubevela, dagger, datadog-agent, maru, terraform-mcp-server, goreleaser, mcp-grafana, k8sgpt, loki, nuclei, nfpm, weaviate, gitlab-runner, witness, k3s, teleport, redpanda, lazygit,...