Critical SSRF and Session Spoofing in Grafana MCP

Pillar Security identified a critical vulnerability chain in Grafana’s Model Context Protocol (MCP) server, affecting over 1.9 million downloads. The flaw enables unauthenticated attackers to spoof session identifiers and invoke administrative tools using the server's own service account.

Technically, the issue combines a missing authentication boundary with a critical SSRF (CVE-2026-19516). By exploiting the `grafana_api_request` tool, attackers can bypass host restrictions to reach internal services, including cloud metadata endpoints (IMDSv2) to exfiltrate short-lived credentials.

This is highly urgent for organizations using AI agents to query observability data. While Grafana released v1.1.0 to address these issues, the new authentication mechanism is optional and must be explicitly enabled to mitigate the risk.