Grafana MCP grafana_api_request SSRF - X-Grafana-URL targeting internal/link-local range

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•3

Detects Server-Side Request Forgery (SSRF) attempts against Grafana instances using the 'X-Grafana-URL' header. The rule identifies requests attempting to access internal network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254, localhost) via the Grafana MCP interface, particularly when non-GET HTTP methods are used to potentially mutate internal resources.