Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
6
2
Contributors
8
Categories
5
5
3
3
2
Platforms
5
3
3
1
Products / Services
6
2
2
1
MITRE Techniques
8
5
5
3
CVEs
71
71
64
58
49
IDS Classtypes
2
IDS Protocols
2
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
KQL Query from file: cve-2026-19516-ssrf-exploitation-attempt-against-mcp-grafana-100.kql
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.