CVE-2026-89039

Medium

Description

A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory (path traversal). The working-directory restriction applied to '@'-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it.

SeverityMedium

CVSS6.5

Exploit probability—

Product

Grafana Mcp-k6

PublishedOct 5, 2026

First seenOct 5, 2026

Weakness typeCWE-22Path traversal CWE-424CWE-424

How to fix

Update

Grafana mcp-k60.7.0 or later

Vendor advisories

grafana.com/security/security-advisories/cve-2026-89039

Affected products

Product	Affected versions	Fixed in
Grafana mcp-k6	0.3.0 ≤ v < 0.7.0	0.7.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.