The Caller Brings Nothing. Your Agent's Credential Does the Work. Grafana's MCP Server and AWS AgentCore, and the Blind Spot We Found in Our Own Judge Before We Wrote This.
Two pieces of agent research from the last six weeks describe the same failure from opposite ends. In Grafana's MCP server, a caller who brought no credential at all could make the server act with its own Grafana service-account token. In AWS AgentCore, a poisoned support ticket made the agent's own shell read its harness's memory and hand over the service account's token. In both, the attacker never needed a key. The agent already had one. While researching this post we found that our own MCP judge, Dredd, would have waved the vulnerable Grafana version through. We fixed that first, then wrote this.
Grafana MCP: a session ID that nobody issued
Pillar Security's Ariel Fogel reported two problems in Grafana's MCP server on August 2. The first: the server checked that an Mcp-Session-Id header looked right, not that the server had ever issued it. Anyone who could reach the server could make one up locally, list the tools and call them. Those calls ran with the Grafana service-account token sitting in the server's environment. Grafana shipped optional bearer-token authentication in v1.1.0 on August 10, and treated it as a hardening improvement rather than a vulnerability, so it carries no CVE.
The second problem did get one. CVE-2026-19516, rated 9.1, is in the grafana_api_request tool. It honored a caller-supplied X-Grafana-URL header, so the caller chose where the server sent its request, plus the method, path, body and headers. Grafana's token did not go to the foreign host, but the server still made the request and returned the answer. In a lab with canary credentials, Pillar used that to walk an IMDSv2-style cloud metadata flow. Grafana's advisory lists the fix as version 1.1.0 or later. Nobody has reported this exploited in the wild.
AWS AgentCore: the shell can read the room
Unit 42's Niv Rabin published the AgentCore research on September 18. A support ticket carried a hidden HTML comment telling the agent to download a script and run it. AgentCore Harness ships with a shell tool on by default, and in the test it ran as root with the same user ID as the harness process itself. The script read that process's memory, found a 1,034-byte token for the operator's mcp-service account, and posted it out. From a laptop with no AWS credentials, the researchers used it to list the MCP tools, look up customer records and open a ticket.
AWS closed the report as informative under its shared responsibility model and pointed to two customer controls: scoping allowedTools and filtering egress. That makes the fix yours. Unit 42's recommendations: scope allowedTools when you invoke the harness, not when you create it, because the create call does not scope tool selection. Remove the shell and file tools from any session that does not need them. Give every vault service account only what its integration needs. Alert on egress to anything outside your integration list. This was also a lab demonstration, not an observed attack.
The shape: the tool runs as the server, so whoever reaches the tool borrows it
Neither bug needed the attacker to steal a password first. The agent's identity was the prize, and the bug was a path to borrow it. One path was a missing check on who was calling. The other was an instruction hidden in the data the agent was asked to read. If you run agents, the question to ask about every tool is not "what can this tool do" but "whose credential does it do it with, and who can reach it." That is the soft middle the armor does not cover.
Our judge was numb to this, so we fixed it before publishing
Dredd is our free MCP pre-flight checker. You ask it about a server before your agent uses it, and it returns BLOCK, ADVISORY, REVIEW or ALLOW. At 15:01 UTC today we asked it about mcp-grafana v1.0.0, a version before the fix. It said ALLOW. Dredd knew the server and checked its reputation and dependencies against our threat data, but it never asked whether the server itself had a published CVE.
The obvious data sources would not have helped. GitHub's advisory for this CVE, GHSA-fr94-7cqc-vjrq, is unreviewed: no package, no repository link, no version range. The only thing tying CVE-2026-19516 to mcp-grafana is the description text. So we matched on text. We pulled the 802 NVD records that mention MCP or Model Context Protocol and matched them against all 42,620 servers in the official MCP Registry. A strong match means the CVE names the repository or its owner. A name-only match is labeled as one, with a note to confirm it is the same project. That produced 157 matches, 110 of them strong. Where NVD has no fixed version and the vendor published one, we fill it in from the vendor. A known CVE moves a verdict to ADVISORY, never BLOCK. We keep BLOCK for actual compromise, because false positives are the price our users pay.
At 15:27 UTC, the same question returned ADVISORY, critical, CVE-2026-19516, version affected. mcp-grafana v2.0.2 returns ALLOW, because it is fixed. We wrote this post after that, not before.
Check yours, free
Ask Dredd about any MCP server you run: analytics.dugganusa.com/api/v1/dredd/preflight?server=io.github.grafana/mcp-grafana&version=v1.0.0, with your server's registry name and version. No key needed. Read the vuln_check block in the answer: checked tells you the lookup actually ran, and affecting_this_version tells you whether your version is in range. If you run mcp-grafana, upgrade and turn on bearer-token auth for any remote transport. If you run AgentCore, open your InvokeHarness calls today and look for the shell tool.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=agent-runs-on-your-credential-grafana-mcp-agentcore-dredd-cve-blind-spot
Comments