Breaking

Pillar Security Reports Grafana MCP Flaw Enabling Unauthenticated Internal-Network Proxying

September 4, 2026 at 07:51 EDT

Security
AI Agents

Pillar Security has identified an authentication gap in Grafana MCP that could let an unauthenticated, network-reachable caller invoke tools with the server’s configured Grafana identity and chain that access into internal-network requests. Grafana released mcp-grafana v1.1.0 with optional caller authentication and removed the header used to redirect outbound requests.

September 4, 2026 · Grafana MCP

Grafana MCP could proxy internal requests

Before v1.1.0, network-facing deployments could accept self-generated session IDs and invoke tools without caller authentication. A redirectable request tool then exposed the server’s own network reach.

The risk in four numbers

9.1

Critical CVSS

8.6

Earlier CVSS

1.9M+

Cumulative Docker Hub pulls

401

Unauthenticated response after token protection

Criticality at a glance

The taller vertical stack represents the higher CVSS score.

CVE-2026-15583
High · 8.6

CVE-2026-19516
Critical · 9.1

How the chain worked

Reach the endpoint

→

Submit a self-generated session ID

→

Invoke grafana_api_request

→

Read the internal response

Optional auth is not automatic

Operators must configure caller authentication for network-facing transports after upgrading.

Caller token

Set --server-auth-token or MCP_GRAFANA_SERVER_TOKEN

Protected transports

SSE and streamable HTTP

Rejected caller

HTTP 401 before any tool runs

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.