# mcp-k6: a Grafana MCP prompt returned any file the server could read

> One prompt on Grafana's mcp-k6 server returned any file its user could read, including SSH keys and cloud credentials.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Grafana Labs
- **Disclosed:** 2026-10-05
- **CVE:** CVE-2026-89039
- **CVSS:** 6.5
- **Affects:** mcp-k6
- **Research by:** bebold6133
- **Primary source:** https://grafana.com/security/security-advisories/cve-2026-89039
- **Page:** https://theinjection.dev/items/grafana-mcp-k6-prompt-file-read/

CVE-2026-89039 is an arbitrary file read in mcp-k6, Grafana's experimental k6 MCP server, where the convert_playwright_script prompt returned the contents of any file the server's user could read. Grafana fixed it in 0.7.0.

## What happened

Grafana Labs published an advisory for CVE-2026-89039 on October 5, 2026, covering mcp-k6, its MCP server for the k6 load testing tool. The CVE record credits a researcher named bebold6133 and records the discovery as a bug bounty finding. Grafana shipped the fix in mcp-k6 0.7.0 on the same day.

## How it works

The convert_playwright_script prompt accepted a file path in its playwright_script argument and returned that file's contents to the caller. mcp-k6 restricted paths beginning with '@' to the working directory, but a bare path skipped that check, and a leading '~' expanded to the user's home directory. The server never canonicalized the path, so a symbolic link placed inside the working directory could point outside it and bypass the restriction too.

## Who is affected

Releases from 0.3.0 up to 0.7.0 carry the flaw, and Grafana's README describes the server as experimental. The CVSS vector requires low privileges, so the caller must already be able to invoke prompts on the server. What is exposed is whatever the account running mcp-k6 can read, which Grafana names as SSH keys and cloud credentials in that user's home directory.

## What to do

Upgrade mcp-k6 to 0.7.0 or later. Grafana's release notes for 0.7.0 say a broken release workflow pushed no container image, so deployments that pull images need another path to the fixed version. Rotate any SSH key or cloud credential readable by the account that ran an affected server.

## Quick facts

- **Affected:** mcp-k6 0.3.0 up to 0.7.0
- **Fixed in:** mcp-k6 0.7.0, released October 5, 2026
- **CVE:** CVE-2026-89039
- **CVSS:** 6.5 medium, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- **Found by:** bebold6133, recorded as a bug bounty finding
- **Attack type:** Path traversal through an MCP prompt argument
- **Status:** Fixed, no container image published for 0.7.0

## Sources

1. [Grafana Advisory](https://grafana.com/security/security-advisories/cve-2026-89039)
2. [GitHub Advisory](https://github.com/advisories/GHSA-ffg3-vfrj-4mjj)
3. [mcp-k6 0.7.0 Release](https://github.com/grafana/mcp-k6/releases/tag/v0.7.0)
4. [mcp-k6 Repo](https://github.com/grafana/mcp-k6)