← Vulnerability feed

Vulnerability record · CVE-2026-15583 · published 15 July 2026

CVE-2026-15583: A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the serve…

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

8.6 CVSS 3.1 High EPSS 0.53% · top 57.6% CWE-610 · CWE-610 Awaiting Analysis
8.6CVSS 3.1 base score
0.53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
1References
15 Jul 2026Last modified by NVD

Description

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

LinkTags
https://grafana.com/security/security-advisories/cve-2026-15583

Track CVE-2026-15583 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.1CVE-2025-0111PAN-OS authenticated file read via management web interfacePAN-OS contains an authenticated file read vulnerability that lets a user with network access to the management web interface read files on the PAN-O…KEVEPSS 2.0%analysed9.1CVE-2022-27593QNAP Photo Station external resource reference allows system file modificationQNAP Photo Station on NAS devices contains an externally controlled reference to a resource flaw (CWE-610) that lets an attacker modify system files.…KEVEPSS 88%analysed

Source: NIST National Vulnerability Database (record CVE-2026-15583), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.