Vulnerability Report

CVE-2026-19516

Title: Grafana SSRF via X-Grafana-URL Header

SSRF

Proof Of Concept

PoC Available for CVE-2026-19516

CWE Category CWE-918

Published Date Aug 11, 2026

Modified Date Aug 31, 2026

Exploit Status Available

Score 9.1 CVSS v3.1

Exploit Probability (EPSS)

0.31%

Vulnerability Summary

CVE-2026-19516: A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

Impacted Vendors

Analysis in Progress...

Reference Links

https://grafana.com/security/security-advisories/cve-2026-19516

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-19516 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/HORKimhab/CVE-2026-19516

View Code

August 31, 2026 MODIFIED

Vulnerability data updated via NVD.

August 11, 2026 MODIFIED

Vulnerability data updated via NVD.

August 11, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Affected Stack

No specific products linked.