Tools AI Risk Radar ai-incident-0126
Incident record
Grafana k6 MCP tool exposes files outside its directory
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- Grafana k6 MCP server from 0.3.0
- Actor
- researcher
- CVE
- CVE-2026-89039
What happened
A caller able to use the script-conversion tool can read files outside its intended working directory. The tool accepts unrestricted paths and symbolic links, subject to the server account’s own file permissions. The CVE was published on 5 October with a CVSS 3.1 score of 6.5 Medium.
The affected range starts at version 0.3.0. The opened advisory identifies no fixed release. The record describes a reported vulnerability; it supplies no evidence of a hostile campaign.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-89039
- GitHub advisory recordgithub.com/advisories/GHSA-ffg3-vfrj-4mjj
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026