mcp-grafana uses caller-supplied X-Grafana-URL to control outbound request destination, and grafana_api_request lets the caller choose HTTP method/path/body. Because destinations aren’t restricted to the configured Grafana instance, an attacker can SSRF internal/loopback/link-local services (incl. metadata) and read responses. Upgrade to mcp-grafana 1.1.0 or later.