Grafana’s MCP server accepted a session ID that looked valid but was never issued

What happened

Pillar Security researcher Ariel Fogel showed that Grafana’s MCP server checked only the shape of a session-ID token rather than whether it had ever been issued, so a caller could invent one that passed and then call tools without credentials. One of those tools, grafana_api_request, also honoured a caller-supplied X-Grafana-URL header, which set the destination, method, path, body and headers of the outbound request.

The two halves are what make it serious. The session check gets an unauthenticated caller in, and the header-controlled request turns the server into a request forger inside the network it sits in, reaching hosts a caller could not otherwise address. NVD scores it 9.1, critical, published 11 August 2026. Grafana’s own advisory covers versions up to and including 1.0.0, with the fix in 1.1.0 adding bearer-token authentication.