CVE-2026-19516

Katalog CVE

CVSS 9.1 · Critical EPSS 0,31%

Kerentanan Server-Side Request Forgery (SSRF). Skor CVSS 3.1 9.1 (Critical) menurut grafana.com.

Deskripsi (NVD)

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Awaiting Analysis

CVSS 3.1

9.1 (Critical), sumber grafana.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://grafana.com/security/security-advisories/cve-2026-19516