What is CVE-2026-15583?

CVE-2026-15583 is a security advisory published by Grafana Labs Security. Grafana MCP server-side request forgery via X-Grafana-URL header

Why does CVE-2026-15583 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by CVE-2026-15583?

CVE-2026-15583 affects 1 product, including: Grafana.

CVE-2026-15583Disclosed before NVD

Grafana MCP server-side request forgery via X-Grafana-URL header

Vendor

Grafana Labs Security

Published

July 15, 2026

Last Modified

—

📋 Description

A vulnerability has been discovered in the mcp-grafana project (https://github.com/grafana/mcp-grafana) where a confused-deputy flaw allows an unauthenticated remote attacker to exfiltrate the server’s environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This vulnerability is classified as Server-Side Request Forgery (SSRF) and also enables credentialed SSRF against arbitrary internal services, including cloud metadata endpoints. Upgrade to a fixed version listed below.

🎯 Affected products1

Grafana

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-15583/