Skip to content
Sign in
8.6 High

CVE-2026-15583 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's…

Description

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

Affected products and versions

Product Affected versions Fixed in
Grafana MCP Server 0.0 0.0.0 → 0.17.1 No fix stated

Other CVEs of Grafana MCP Server

The 2 CVEs of Grafana MCP Server →
CVE-2026-19516 A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the… 9.1 Critical
Track this CVE