Unrated severityNVD Advisory· Published Jul 15, 2026· Updated Jul 29, 2026
SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
CVE-2026-15583
Description
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
1- grafana.com/security/security-advisories/cve-2026-15583mitrevendor-advisory
News mentions
0No linked articles in our index yet.