{"uuid": "c75f61d7-ff6c-4c98-91b0-06db783831d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19516", "type": "seen", "source": "https://bsky.app/profile/nik-kale.bsky.social/post/3mwbmssc5cg22", "content": "CVE-2026-19516, CVSS 9.1, Grafana MCP before 1.1.0. The grafana_api_request tool accepted an X-Grafana-URL header from the caller, and that header controlled the method, path and body of the outbound request. Server-side request forgery from the server's own network position.", "creation_timestamp": "2026-09-24T16:00:07.254979Z"}