Vulnerable mcp-grafana (<1.1.0) invoking grafana_api_request tool

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•0

Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.