Grafana security advisory (AV26-710)

Serial number: AV26-710
Date: July 16, 2026

On July 15, 2026, Grafana published security advisories to address vulnerabilities in the following products:

• Grafana MCP Server – version 0.17.1 and prior
• Grafana Loki – version 3.7.0 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Grafana MCP server-side request forgery via X-Grafana-URL header
• Loki detected_fields query limits results in unbounded memory allocation
• Grafana Blog