CVE-2026-19516 SSRF exploitation attempt against mcp-grafana <=1.0.0

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•2

Detects Server-Side Request Forgery (SSRF) attempts targeting vulnerable versions of Grafana MCP Server (versions < 1.1.0). The rule identifies requests attempting to access sensitive internal or cloud-metadata endpoints (e.g., 169.254.169.254, localhost, internal subnets) via the X-Grafana-URL header.