Security research: CVEs from coordinated disclosure

The findings

Four CVEs, each with a source.

Sorted by severity. Where the CVE record at MITRE is not yet published, we list the ID as “assigned” and link the project's GitHub advisory.

CVE-2026-15583fixed

Grafana MCP Servergrafana/mcp-grafana

What an attacker could have done: redirect the MCP server's credentials for your Grafana to a server of their own.

Through the X-Grafana-URL header, the caller could decide which host the server sent its credentials from the environment to. Technical term: SSRF, or confused deputy.

Severity: CVSS 8.6 (per the CVE record)
Affected: up to and including 0.17.1
Fixed: in 0.17.2 (released 13 July 2026)
Published: 15 July 2026, Grafana as CNA
Credit: CyberSec42 (in the CVE record)

Technical write-up → CVE record Grafana advisory GHSA-7cfp-pmw3-4j7r

CVE-2026-114123fixed

d365fo-mcp-servernpm: d365fo-mcp

What an attacker could have done: retrieve proprietary X++ source code over the internet without signing in.

The official Azure one-click deployment ran without authentication by default, which left proprietary X++ source code reachable over the internet. Classes: missing authentication and insecure default (CWE-306, CWE-1188).

Severity: CVSS 7.5, high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected: up to and including 1.10.1
Fixed: in 1.11.0
Published: advisory 12 Aug 2026, CVE 21 Oct 2026
Credit: lwebmedia (CyberSec42) on the GitHub advisory

Technical write-up → GHSA-8764-fh3m-wf7g CVE record

CVE-2026-104776assignedfixed

mcp-server-kubernetesnpm: mcp-server-kubernetes

What an attacker could have done: read files from the server the MCP server runs on.

The kubectl_patch tool lacked the path check for remote transport that all of its sibling tools had. As a result, patchFile allowed reading arbitrary files on the server (CWE-73).

Severity: CVSS 7.1, high
Affected: up to and including 4.1.0
Fixed: in 4.1.1
Published: advisory 2 Oct 2026, CVE assigned
Credit: lwebmedia (CyberSec42) on the GitHub advisory

Technical write-up → GHSA-6963-p4fp-2wxw

CVE-2026-110787assignedfixed

pRESTprest/prest, Go

What an attacker could have done: see databases, schemas and tables that were meant to be hidden.

The MCP endpoint /_mcp bypassed the ExposureMiddleware and exposed databases, schemas and tables that were meant to be hidden via expose.* (CWE-284).

Severity: CVSS 5.3, medium
Affected: up to and including 2.4.0
Fixed: in 2.4.1
Published: advisory 29 Jul 2026, CVE assigned
Credit: lwebmedia (CyberSec42) on the GitHub advisory

Technical write-up → GHSA-x62p-38px-pp73

We thank the maintainers of Grafana MCP Server, d365fo-mcp-server, mcp-server-kubernetes and pREST for working with us under coordinated disclosure. Information as of 28 October 2026.

The pattern behind them

The gaps sit at trust boundaries.

None of these findings is an exotic trick. Each one appears where a system trusts an input, a default or a new access path more than it should. Those are the places we check first.

01 · CVE-2026-104776

One tool lacks a check its siblings have

Every tool checks the path except one. Gaps like this only show up when every tool is held against the same rule.

02 · CVE-2026-114123

The default configuration ships without sign-in

Anyone following the official deployment inherits its defaults. If those include no authentication, the service is open.

03 · CVE-2026-110787

A new MCP access path bypasses existing access control

The rules for what may be visible applied to the existing path. The new MCP endpoint went around them.

04 · CVE-2026-15583

Credentials follow a URL set by the caller

If the caller picks the destination and the server attaches its own credentials, those credentials end up wherever the caller wants.

How we report

Coordinated disclosure: the fix first, then publication.

Step 1

Report privately

We report the finding confidentially through the project's reporting channel, with a description and proof. Nothing is said in public.

Step 2

Wait for the fix

The maintainers fix the issue and release a corrected version. Until then the finding stays confidential.

Step 3

CVE via a CNA or GitHub

The CVE ID is assigned by a CNA: the vendor itself, such as Grafana, or GitHub through the project's security advisory.

Step 4

Only then publish

Only after the fix and the advisory do we list the finding here, with ID, affected and fixed version, and source.

What this means for your assessment

The same method, applied to your systems.

The findings above come from the same way of working we use on client systems: map the trust boundaries, hold every tool against the same rule, and back every finding with proof before reporting it. For you, this happens as an authorised assessment within a scope agreed in writing. A public finding demonstrates the method; it is not a statement about the security of your system.

→