What is the CVSS score of CVE-2026-15583?

CVE-2026-15583 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Grafana MCP Server are affected by CVE-2026-15583?

A critical, unauthenticated vulnerability in Grafana MCP Server (CVE-2026-15583) enables attackers to steal administrative service-account tokens and access internal systems and cloud infrastructure,…

How to fix or mitigate CVE-2026-15583?

Within 24 hours: Inventory all Grafana MCP Server deployments and assess network exposure (public vs. internal-only). Within 7 days: Restrict MCP server access to internal networks only, disable internet-facing access, and implement Web Application Firewall rules to block X-Grafana-URL header patterns. Enable comprehensive Grafana audit logging to detect suspicious token usage. Within 30 days: Subscribe to Grafana security advisories for patch release, develop an emergency deployment plan, rotate all service-account tokens currently in use on MCP servers, and execute patching immediately upon vendor release.

Grafana MCP Server CVE-2026-15583

EUVD-2026-44597 HIGH

Externally Controlled Reference to a Resource in Another Sphere (CWE-610)

2026-07-15 GRAFANA

GHSA-7cfp-pmw3-4j7r

SSRF Grafana Grafana Mcp Server

8.6

CVSS 3.1 · Vendor: GRAFANA

Severity by source

Vendor (GRAFANA) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated network request with a single crafted header (AV:N/AC:L/PR:N/UI:N); token disclosure and reach into other systems drive C:H and S:C, with no direct integrity/availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GRAFANA).

CVSS VectorVendor: GRAFANA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 08:01 vuln.today

CVE Published

Jul 15, 2026 - 07:29 cve.org

HIGH 8.6

DescriptionCVE.org

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

AnalysisAI

Server-side request forgery and credential theft in Grafana MCP Server lets an unauthenticated remote attacker steal the server's environment-configured Grafana service-account token by sending a crafted X-Grafana-URL request header, and pivot to reach arbitrary internal services including cloud metadata endpoints. The token grants the attacker the MCP server's full Grafana privileges, and the SSRF primitive exposes internal infrastructure behind the network perimeter. No public exploit identified at time of analysis, but the CVSS 8.6 (scope-changed) rating and unauthenticated network vector make this a high-priority fix.

Technical ContextAI

Grafana MCP Server is a Model Context Protocol (MCP) server that bridges AI assistants/agents to a Grafana instance, authenticating to Grafana with a service-account token typically supplied through an environment variable. This is a confused-deputy weakness: the server trusts a client-controlled X-Grafana-URL header to decide which Grafana endpoint to talk to, so an attacker can redirect the server's authenticated outbound request to a host they control and capture the attached service-account token, or point it at internal-only addresses. The root-cause classes are CWE-441 (Confused Deputy) and CWE-918 (Server-Side Request Forgery); the CWE field is marked N/A in the source data, so these are inferred from the described behavior. The affected CPE is cpe:2.3:a:grafana:grafana_mcp_server with an unbounded version range (all versions prior to the fix).

RemediationAI

Patch available per vendor advisory - upgrade Grafana MCP Server to the fixed release identified in Grafana's advisory at https://grafana.com/security/security-advisories/cve-2026-15583 (no exact fix version is present in the provided data, so confirm the target version directly from that page). As compensating controls until patched: place the MCP server behind authentication and network ACLs so untrusted clients cannot reach it, and strip or ignore attacker-supplied X-Grafana-URL headers at a reverse proxy so the server only ever talks to a hardcoded internal Grafana URL (trade-off: breaks any legitimate multi-tenant/dynamic-target use of that header). Additionally, enforce egress filtering so the MCP server cannot make outbound connections to arbitrary hosts or to cloud metadata endpoints such as 169.254.169.254, and where the platform supports it require IMDSv2 to blunt metadata-credential theft (trade-off: may break legitimate integrations that rely on broad outbound access). Rotate the Grafana service-account token after patching, since it may already have been exposed, and scope that token to least privilege.