{"vulnerability": "cve-2026-19516", "sightings": [{"uuid": "80f5d7be-b8d2-47ac-9df9-4422d2509b47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-19516", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117075347103329501", "content": "Grafana MCP Server hit by CRITICAL SSRF (CVE-2026-19516, CVSS 9.1) via X-Grafana-URL header. Attackers can access internal endpoints and metadata. Restrict access & monitor usage until patch available. https://radar.offseq.com/threat/cve-2026-19516-cwe-918-in-grafana-grafana-mcp-server-3995ac1dff45c6f5 #OffSeq #Grafana #SSRF #Vuln", "creation_timestamp": "2026-08-11T06:00:26.535949Z"}, {"uuid": "49dbf790-36c2-46d8-8bb9-421cb5db6827", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-19516", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msrwrzr6an25", "content": "Grafana MCP Server faces CRITICAL SSRF (CVE-2026-19516, CVSS 9.1). Unrestricted outbound requests risk internal data exposure. Restrict access & monitor X-Grafana-URL header. Details: https://radar.offseq.com/threat/cve-2026-19516-cwe-918-in-grafana-grafana-mcp-server-3995ac1dff45c6f5 #OffSeq #Gr...", "creation_timestamp": "2026-08-11T06:00:28.585100Z"}, {"uuid": "985f4947-1ced-49c4-90c0-796fdd850129", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mu7xjn3nwj2g", "content": "~Cybergcca~\nPaperCut CVE-2026-81578 and CVE-2026-82078 are exploited in the wild; patch affected products.\n-\nIOCs: CVE-2026-81578, CVE-2026-82078, CVE-2026-19516\n-\n#PaperCut #ThreatIntel #Vulnerability", "creation_timestamp": "2026-08-29T13:16:08.083570Z"}, {"uuid": "4b848ef0-2ed2-49ad-ae20-3ff5cc2c5d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mssyhz6atn2c", "content": "~Cybergcca~\n4 advisories covering Grafana, HashiCorp Vault, SAP, and AMD EPYC vulnerabilities\u2014apply updates promptly.\n-\nIOCs: CVE-2026-19516\n-\n#PatchNow #ThreatIntel #Vulnerability", "creation_timestamp": "2026-08-11T16:03:19.255963Z"}, {"uuid": "3118fe8e-5173-4223-aa37-9fb8d29ce137", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-19516", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/grafana-security-advisory-av26-796", "content": "", "creation_timestamp": "2026-08-11T16:15:03.642509Z"}, {"uuid": "e8e9a56b-1606-4360-b79d-630b86ec1623", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-19516", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/grafana-security-advisory-av26-860", "content": "", "creation_timestamp": "2026-08-28T16:15:12.445366Z"}, {"uuid": "b9616421-f6ca-4a0f-b229-23975e20046f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9970", "content": "\ud83d\udea8 Unauthenticated attackers could turn Grafana MCP servers into proxies for internal networks and cloud metadata endpoints.\n\nPillar Security research team found affected releases accepted self-generated session IDs in place of authentication, exposing the server's Grafana service account to anyone who could reach it.\n\nA chained SSRF (CVE-2026-19516, CVSS 9.1) then let callers pick the destination, method, headers, and body of outbound requests. The server has passed 1.9 million Docker Hub downloads; Grafana shipped fixes in mcp-grafana v1.1.0.\n\nFull details here: https://thn.news/grafana-mcp-flaws", "creation_timestamp": "2026-09-04T13:00:04.761587Z"}, {"uuid": "25557b66-f626-46c3-ba54-d831124eb1ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "seen", "source": "Telegram/lpcaxohlevWOQx_YAX_9XUMgFve84tVn0viR4d8tnkij6ww", "content": "", "creation_timestamp": "2026-09-04T18:00:03.645045Z"}, {"uuid": "35230892-2027-462a-946a-249015836865", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "creation_timestamp": "2026-09-05T01:00:04.478841Z"}, {"uuid": "0d74c2c8-5821-467b-8079-7f2f3404b7de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9970", "content": "\ud83d\udea8 Unauthenticated attackers could turn Grafana MCP servers into proxies for internal networks and cloud metadata endpoints.\n\nPillar Security research team found affected releases accepted self-generated session IDs in place of authentication, exposing the server's Grafana service account to anyone who could reach it.\n\nA chained SSRF (CVE-2026-19516, CVSS 9.1) then let callers pick the destination, method, headers, and body of outbound requests. The server has passed 1.9 million Docker Hub downloads; Grafana shipped fixes in mcp-grafana v1.1.0.\n\nFull details here: https://thn.news/grafana-mcp-flaws", "creation_timestamp": "2026-09-05T01:00:28.791065Z"}, {"uuid": "1ad5e6b0-8c77-49f3-8299-702968e4e04d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "published-proof-of-concept", "source": "Telegram/lpcaxohlevWOQx_YAX_9XUMgFve84tVn0viR4d8tnkij6ww", "content": "", "creation_timestamp": "2026-09-05T01:00:21.184857Z"}, {"uuid": "8fb16468-123a-45ce-a7de-07379a0258f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3muqxisfb7x24", "content": "Valid, But Never Issued: Session Spoofing and SSRF in Grafana MCP (CVE-2026-19516) #patchmanagement", "creation_timestamp": "2026-09-05T07:30:55.473668Z"}, {"uuid": "bf2926aa-41a3-4f69-868a-e08c23ede9ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "creation_timestamp": "2026-09-06T00:01:03.572885Z"}]}