CVE-2026-15583

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-15583 CVE-2026-15583 Grafana MCP Server 0.17.0 — Grafana Labs Я @abraxasnull. Loopback-лаборатория. Клиент — CVE-2026-15583-Abraxas-Labs.py. Confused deputy. Неаутентифицированный MCP HTTP берёт X-Grafana-URL...

CVE-2026-15583

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...

CVE-2026-15583

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...

EUVD-2026-44597

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...

CVE-2026-15583 SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...

CVE-2026-15583

Grafana MCP Server is affected by CVE-2026-15583, a confusion-deputy vulnerability that allows an unauthenticated remote attacker to exfiltrate the server’s Grafana service-account token and perform SSRF via a crafted X-Grafana-URL header. The flaw enables targeting internal services, including c...

CVE-2026-15583: Externally Controlled Reference to a Resource in Another Sphere

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...

PT-2026-58884

Name of the Vulnerable Software and Affected Versions Grafana MCP Server affected versions not specified Description A confused-deputy flaw allows an unauthenticated remote attacker to exfiltrate the environment-configured Grafana service-account token. This is achieved by supplying a crafted...