8.6
Élevée
CVE-2026-15583 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's…
Description
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Grafana MCP Server 0.0 | 0.0.0 → 0.17.1 | Pas de correctif indiqué |