CVE-2026-15583

SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

High · published July 15, 2026

CVSS v3.1
8.6
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.9th percentile
Published
2026-07-15T07:29Z
EPSS history
Timeline
  • 15 JUL 07:29Z
    SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
    cvelistv5