Description

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-11T06:17:13.433Z",
  "pubdate": "2026-08-11T06:17:13.433Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability exists within the mcp-grafana product, specifically involving the handling of outbound HTTP requests. The flaw stems from insufficient validation of destination targets supplied by callers via the X-Grafana-URL request header and the grafana_api_request tool, which permits arbitrary selection of HTTP methods, paths, and bodies.\nThe impact of this vulnerability allows malicious actors to direct outbound HTTP traffic from the vulnerable server toward internal network services, loopback interfaces, link-local network segments, and cloud provider metadata endpoints. By reading the responses from these unauthorized internal targets, attackers can compromise internal infrastructure confidentiality and integrity.\nThe risk implications are critical, as previous remediation efforts associated with CVE-2026-15583 only restricted the transmission of the configured service-account token to unintended destinations rather than completely blocking the unauthorized routing of requests. Consequently, attackers with access to the vulnerable interface can leverage the server as a proxy to bypass network perimeters.\nExploitation requirements include the ability to issue requests to the mcp-grafana application with manipulated headers and tool parameters. No complex cryptographic bypasses are necessary once access to the vulnerable functionality is achieved.",
  "technicalDetails": "The vulnerability resides in the request routing logic of mcp-grafana, where the destination of outbound HTTP requests is dynamically controlled by the caller-supplied X-Grafana-URL request header. Furthermore, the grafana_api_request tool exposes granular control over request construction, permitting callers to arbitrarily choose the HTTP method, uniform resource identifier path, and message body.\nThe root cause of the vulnerability is the lack of strict destination whitelisting or domain restriction enforcement. Although CVE-2026-15583 was previously addressed by preventing the leakage of the configured service-account token to unintended external or third-party destinations, the underlying architecture failed to restrict the actual network destinations themselves, allowing requests to be dispatched to arbitrary endpoints.\nDuring the attack flow, an unauthenticated or authenticated caller initiates an HTTP request to mcp-grafana containing a modified X-Grafana-URL header pointing to an internal resource, such as http://169.254.169.254/latest/meta-data/ or an internal microservice running on the loopback interface (127.0.0.1). The attacker simultaneously utilizes the grafana_api_request tool parameters to structure the payload, method, and path to query the targeted internal service.\nThe vulnerable component processes the request and dispatches an outbound connection from the host running mcp-grafana to the internally specified target. Upon receiving the response from the internal service—which may contain sensitive environment configurations, cloud metadata tokens, or internal application data—mcp-grafana reads and returns the response data to the caller, completing the server-side request forgery cycle and exposing internal assets to unauthorized actors."
}