GO-2026-4514 vulnerabilities

Vulnerabilities for packages: nuclei, kubevela, vcluster, datadog-agent, terragrunt, teleport, weaviate, malcontent, redpanda, dagger, dgraph, k8sgpt, eksctl, loki, rclone, grafana-alloy, witness, ollama, minio, nfpm, opentelemetry-collector-contrib, terraform-mcp-server, tempo,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: minio-operator, grafana-pyroscope, minio-object-browser, datadog-agent, trillian, karma, splunk-otel-collector, mc, loki, jaeger, cloud-sql-proxy, minio, istio, keda, tempo, telegraf, prometheus-pushgateway, certificate-transparency, mcp-grafana, aws-otel-collector...

CVE-2026-19516

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516

The CVE describes SSRF in Grafana’s mcp-grafana outbound requests: a caller-supplied X-Grafana-URL header plus grafana_api_request can set HTTP method, path, and body, enabling directing requests to internal, loopback, and link-local services (including metadata endpoints) beyond the configured G...

EUVD-2026-55938

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

PT-2026-70062

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana api request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can dire...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: minio-operator, node-problem-detector, minio-object-browser, datadog-agent, trillian, karma, fluent-bit-plugin-loki, amazon-cloudwatch-agent-operator, splunk-otel-collector, mc, k8sgpt, loki, jaeger, cloud-sql-proxy, minio, opentelemetry-operator, istio,...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: aws-otel-collector, mc-fips, minio, splunk-otel-collector-fips, prometheus-fips, cloud-sql-proxy-fips, metrics-server, istio-fips, ld-relay, opentelemetry-collector-contrib-fips, istio, minio-operator-fips, k8sgpt, nrdot-collector-k8s-fips, tempo-fips,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: nuclei, kubevela, vcluster, datadog-agent, terragrunt, teleport, weaviate, malcontent, redpanda, dagger, dgraph, k8sgpt, eksctl, loki, rclone, grafana-alloy, witness, ollama, minio, nfpm, opentelemetry-collector-contrib, terraform-mcp-server, tempo,...