Grafana security advisory (AV26-860)
Canada's Cyber Centre warned that Grafana Alloy versions through 1.18.1 are affected by CVE-2026-19516 and urged users to apply available updates.
Canada's Cyber Centre issued advisory AV26-860 warning that Grafana Alloy versions prior to or equal to 1.18.1 are affected by CVE-2026-19516. The bulletin directs users and administrators to vendor resources and available patches. No exploitation or severity details are included in the advisory text.
- Affects Grafana Alloy versions prior to or equal to 1.18.1
- Tracked as CVE-2026-19516
- Cyber Centre urges users to apply available updates
- CVEs
- CVE-2026-19516
- Vendors
- Grafana Labs
- Products
- Grafana Alloy
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19516 | A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller… | 9.1 | <1% |
From the original article
Serial Number: AV26-860 Date: August 28, 2026 As of August 27, 2026, Grafana is affected by a vulnerability in the following product: Alloy Prior to or equal to 1. 18. 1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.