Grafana MCP Server CVE-2026-15583

Exploitation requires that a Grafana MCP Server instance be network-reachable by the attacker and that it be configured with a Grafana service-account token in its environment (the credential the flaw exfiltrates). The concrete trigger is a client-supplied X-Grafana-URL request header, which the server trusts to select its outbound target - no authentication, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). What limits exploitation is deployment reach rather than technical difficulty: the target must actually run the MCP server component and expose it to untrusted clients, and SSRF impact against internal services (e.g., cloud metadata) depends on the server's network position and egress rules. If a reverse proxy strips the X-Grafana-URL header or the server is not reachable from untrusted networks, exploitation is blocked.

The signals align toward genuine priority rather than paper severity: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N describes network-reachable, low-complexity, unauthenticated exploitation with a scope change (base 8.6), which matches the description of a header-triggered token exfiltration plus SSRF. Confidentiality impact is High (service-account token disclosure) while integrity and availability are rated None, though the SSRF-to-internal-services capability arguably enables downstream integrity risk not captured in the base score. No EPSS score, KEV entry, POC, or SSVC decision data is provided, so exploitation probability cannot be quantified from the input; the vulnerability was self-reported by Grafana. The dominant limiting factor is deployment scale - the affected component is a specialized AI-integration add-on rather than core Grafana - so real-world exposure depends on whether an organization runs the MCP server and whether it is reachable by untrusted clients.

An attacker who can reach an internet- or intranet-exposed Grafana MCP Server sends a request carrying a crafted X-Grafana-URL header pointing at an attacker-controlled server, and the MCP server obligingly makes an authenticated outbound request that leaks its Grafana service-account token to the attacker. Using the same primitive, the attacker sets the header to an internal address (for example a cloud metadata endpoint) to perform SSRF and harvest additional internal data or credentials. No authentication or user interaction is required (PR:N/UI:N) and complexity is low, so a single crafted HTTP request suffices; no public POC is currently identified.