Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-15 | 1 | Disclosure1 |
| 2026-07-28 | 1 | Disclosure1 |
| 2026-09-28 | 1 | PoC1 |
For my data and analytics homies... CVE-2026-15583 - Grafana MCP Server - High 8.6 - Unauthenticated Token Exfiltration (X-Grafana-URL Confused Deputy) https://github.com/abraxas/CVE-2026-15583
Post summary
The tweet discloses CVE-2026-15583 with technical details and shares a GitHub repository that likely hosts a proof-of-concept exploit for the vulnerability.
⚠️ Vulnerabilidades en productos Grafana ❗ CVE-2026-21729 ❗ CVE-2026-15583 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-grafana-4/ https://t.co/Qle6GZIWWb
Post summary
The post announces the existence of two newly referenced CVEs in Grafana products, directing readers to reference links for more information.
CVE-2026-15583 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token… https://www.cve.org/CVERecord?id=CVE-2026-15583
Post summary
The post announces CVE‑2026‑15583, detailing a remote unauthenticated token exfiltration flaw in Grafana MCP Server, but provides no exploitation or mitigation information.