Grafana MCP tool execution via session ID without auth header

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•1

Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.