CVE-2026-89039: grafana mcp-k6 Path Traversal

Vulnerability summary

CVE-2026-89039 is a medium (CVSS 6.5) Path Traversal vulnerability in grafana mcp-k6. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.6% of scored vulnerabilities.

Timeline

1. 05-10-2026
   PublishedVulnerability first disclosed.
2. 05-10-2026
   Last modifiedVulnerability information updated.

Description

A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory (path traversal). The working-directory restriction applied to '@'-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-424Improper Protection of Alternate PathThe product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.