Reported by 2 outlets
Grafana Alloy Vulnerability CVE-2026-19516
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Grafana security advisory (AV26-860)
malware.news · 46d ago · August 28th, 2026
Serial Number: AV26-860 Date: August 28, 2026 As of August 27, 2026, Grafana is affected by a vulnerability in the following product: Alloy Prior to or equal to 1.18.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Grafana: The open and composable observability platform | Grafana Labs CVE-2026-19516 CVE Record Article Link: Grafana security advisory (AV26-860) - Canadian Centre for Cyber Security
-
update from www.pillar.security
A session ID is not a credential. Grafana's MCP server only checked that Mcp-Session-Id was well formed, so anyone who could reach it could
www.pillar.security · 13h ago · October 13th, 2026
A session ID is not a credential. Grafana's MCP server only checked that Mcp-Session-Id was well formed, so anyone who could reach it could
via Mastodon https://www.pillar.security/blog/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp