CVE-2026-15583 — SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

CVE-2026-15583

SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header PUBLISHED

Description (CNA)

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana MCP Server	affected 0.0.0 through 0.17.1

CWE

No CWE identifiers supplied.

References

https://grafana.com/security/security-advisories/cve-2026-15583

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.