CVE-2026-89039: CWE-22 in Grafana mcp-k6

The vulnerability exists in the convert_playwright_script prompt of the Grafana Mcp K6 server, where the playwright_script argument accepts file paths. While '@'-prefixed paths are restricted to the server's current working directory, bare paths are resolved via an undocumented code path without such restrictions. This allows an attacker able to invoke the prompt to read any file accessible by the server user, including files outside the working directory. Additionally, '~' expands to the user's home directory, enabling direct access to credential files. The working-directory restriction can also be bypassed using symbolic links inside the working directory that point outside it, as paths are not canonicalized before restriction checks. All releases from v0.3.0 onward are affected, with v0.3.0 and v0.4.0 applying no restrictions to either path form.

An attacker with the ability to invoke the convert_playwright_script prompt can read arbitrary files on the server with the privileges of the server user. This includes sensitive files such as SSH private keys, potentially leading to credential compromise. The vulnerability does not allow code execution or denial of service but results in confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the convert_playwright_script prompt to trusted users only and monitor for unauthorized usage. Avoid running the server with excessive privileges to limit file access scope.