GO-2026-4514 vulnerabilities

Vulnerabilities for packages: grafana, k3s, tempo, k8sgpt, maru, datadog-agent, dgraph, malcontent, gitlab-runner, minio, nuclei, opentelemetry-collector-contrib, terragrunt, redpanda, dagger, prometheus, opentelemetry-collector, loki, vcluster, nfpm, mcp-grafana, teleport, lazygit, weaviate,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: telegraf, tempo, certificate-transparency, karma, datadog-agent, mc, minio, cloud-sql-proxy, loki, aws-otel-collector, mcp-grafana, istio, grafana-pyroscope, trillian, splunk-otel-collector, minio-operator, jaeger, minio-object-browser, keda, prometheus-pushgateway...

CVE-2026-19516

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

EUVD-2026-55938

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516

The CVE describes SSRF in Grafana’s mcp-grafana outbound requests: a caller-supplied X-Grafana-URL header plus grafana_api_request can set HTTP method, path, and body, enabling directing requests to internal, loopback, and link-local services (including metadata endpoints) beyond the configured G...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

PT-2026-70062

Name of the Vulnerable Software and Affected Versions mcp-grafana versions prior to 1.1.0 Description An authentication bypass allows unauthenticated attackers to use self-generated session IDs to gain access to the server's Grafana service account. This can be chained with a server-side request...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: grafana, telegraf, amazon-cloudwatch-agent-operator, k8sgpt, opentelemetry-operator, tempo, certificate-transparency, karma, datadog-agent, mc, minio, opentelemetry-collector-contrib, cloud-sql-proxy, fluent-bit-plugin-loki, opentelemetry-collector, loki,...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: trillian, nrdot-collector-k8s, prometheus, agentbeat-fips, jaeger-fips, mcp-grafana-fips, minio-fips, nrdot-collector-k8s-fips, beats-fips, certificate-transparency, tempo-fips, splunk-otel-collector-fips, certificate-transparency-fips, minio,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: grafana, k3s, tempo, k8sgpt, maru, datadog-agent, dgraph, malcontent, gitlab-runner, minio, nuclei, opentelemetry-collector-contrib, terragrunt, redpanda, dagger, prometheus, opentelemetry-collector, loki, vcluster, nfpm, mcp-grafana, teleport, lazygit, weaviate,...