Is CVE-2026-15583 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-15583?

CVE-2026-15583 has a CVSS v3 severity of HIGH (8.6).

Back

CVE-2026-15583

Description

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.