mcp-grafana Server-Side Request Forgery via Caller-Controlled Request Destination

Technical Analysis

The MCP tool exposes a grafana_api_request capability intended to proxy requests to a configured Grafana instance, but it trusts caller-supplied values (X-Grafana-URL header, HTTP method, path, body) without validating that the resolved destination matches the intended Grafana host. An attacker with access to invoke the MCP tool (directly, or indirectly via a compromised LLM agent that is tricked into calling it with attacker-controlled parameters) can redirect requests to internal services, loopback addresses, link-local ranges, or cloud instance metadata endpoints (e.g., 169.254.169.254) and receive the response back through the tool's normal output path. This crosses the trust boundary between the AI agent/tool-calling layer and the internal network, effectively turning the MCP server into an unauthenticated internal network proxy for any entity capable of prompting or steering the agent. The prior fix for CVE-2026-15583 only prevented the configured Grafana service-account token from being forwarded to arbitrary destinations, but did not restrict where requests could be sent, leaving the SSRF primitive fully intact.

Affected Systems

mcp-grafana; protocols: MCP

Detection Signatures

• Outbound HTTP requests from mcp-grafana host process to non-Grafana IP ranges (RFC1918, 127.0.0.0/8, 169.254.0.0/16)
• Requests containing X-Grafana-URL header values pointing to internal/loopback/link-local/metadata addresses
• Unexpected calls to grafana_api_request with arbitrary path/method/body parameters not matching normal dashboard/API usage patterns
• Access logs on internal services or cloud metadata endpoints showing requests originating from the mcp-grafana server's egress IP
• Tool invocation logs where LLM-generated arguments include full URLs or non-Grafana hostnames in header fields

Remediation Steps

1. 1

   Enforce destination allowlisting

   Restrict mcp-grafana's outbound requests to only the explicitly configured Grafana base URL; reject or ignore any caller-supplied X-Grafana-URL or path values that resolve to a different host.

2. 2

   Block internal/reserved IP ranges

   Implement SSRF-hardening controls that resolve and validate destination IPs before connecting, denying loopback, link-local, and private network ranges regardless of caller input.

3. 3

   Restrict grafana_api_request tool scope

   Limit the tool to a fixed set of pre-approved API paths and methods rather than allowing arbitrary method/path/body combinations from the caller.

4. 4

   Patch immediately

   Upgrade mcp-grafana to the version that fully remediates CVE-2026-19516, verifying the fix restricts destinations and not just credential forwarding.

5. 5

   Network segmentation

   Run MCP servers with egress filtering/firewall rules preventing access to cloud metadata services and internal management interfaces.

6. 6

   Audit and monitor tool calls

   Log and alert on grafana_api_request invocations with unusual headers, non-standard hosts, or metadata-endpoint-like targets.