CVE-2026-15583 in MCP Server
Sumário
de MITRE • 15/07/2026
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.