CVE-2026-15583

The record

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

Affected packages

Related vulnerabilities

• CVE-2026-119342 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-610
• CVE-2026-67077 HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could… CWE-610
• CVE-2026-19032 jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI… CWE-610
• CVE-2026-21810 HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference… CWE-610
• CVE-2026-79256 Externally controlled reference in WebView in Google Chrome on on Android prior to… CWE-610
• CVE-2026-78966 Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a… CWE-610
• CVE-2026-76572 A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. CWE-610
• CVE-2026-68562 A flaw was found in ansible-collection-redhat-leapp. CWE-610