Grafana MCP session spoofing combines with request redirection

Tracking: CVE-2026-15583, CVE-2026-19516
Severity: Multi-vulnerability chain; exposure depends on authentication and reachability

Who is affected

Grafana MCP before 1.1.0, especially network-facing deployments without authentication. The research note tracks CVE-2026-15583 and CVE-2026-19516.

How the attack works

The server accepts a correctly formatted mcp-session-<uuid> without confirming it was issued for the caller. A session-shaped string can therefore reach tools where authentication is not independently enforced.

The grafana_api_request tool also accepts a destination override through X-Grafana-URL. Combining the weaknesses can send requests from the MCP server to loopback, internal, link-local, or cloud metadata addresses. This is server-side request forgery (SSRF), with impact determined by reachable services and their protections.

What to do

1. Upgrade to 1.1.0 or later and verify the running server version.
2. Explicitly configure --server-auth-token and restrict network access. Do not treat a session ID as caller authentication.
3. Restrict outbound destinations and review overridden Grafana URLs, unfamiliar sessions, and metadata requests. Rotate credentials if evidence shows they were exposed.

Scope and limits

A package upgrade and an authentication configuration check are separate parts of remediation.

Sources

• Original advisory or incident report