CVE-2026-15583: Grafana MCP Server, unauthenticated token theft

Unauthenticated MCP HTTP takes X-Grafana-URL from the request and sends the process service-account token to that host. Fixed by not sending the configured token to unintended destinations.

Name: CVE-2026-15583: Grafana MCP Server, unauthenticated token theft
Type: N-day analysis
CVE: CVE-2026-15583
CVE Risk: high
Disclosure Status: public
Vendor: Grafana Labs
Affected: Grafana MCP Server through 0.17.0. Patched in 0.17.1.
Published: 28 Oct 2026
Updated: 28 Oct 2026
Tags: n-day, grafana, ssrf, cwe-918

Grafana MCP Server, unauthenticated token theft

Grafana MCP Server 0.17.0 - Grafana Labs

I am @abraxas_null. Loopback lab. The client is CVE-2026-15583-Abraxas-Labs.py.

Confused deputy. Unauthenticated MCP HTTP takes X-Grafana-URL from the request and the service-account token from the environment, then GET {url}/api/frontend/settings with Authorization: Bearer. Empty X-Grafana-Service-Account-Token falls back to env. Fixed in 0.17.1 by not sending the configured token to unintended destinations.

CVE-2026-15583 (NVD). CWE-918. Vendor: Grafana Labs. Grafana MCP Server through 0.17.0. Patched in 0.17.1.

What an attacker can do

POST /mcp or GET /sse with X-Grafana-URL pointing at a collector you control. The server ships GRAFANA_SERVICE_ACCOUNT_TOKEN (or GRAFANA_API_KEY) to you. That is credentialed SSRF plus token theft. Lab oracle is the witness token in the collector Authorization header.

How this showed up in the lab

I mapped extractKeyGrafanaInfoFromReq / ExtractGrafanaInfoFromHeaders, then NewGrafanaClient fetchPublicURL, then AuthRoundTripper. Stood up mcp-grafana 0.17.0 with a loopback collector.

Fail-controls already in the lab: eval/base64/system is not the witness; a reverse shell is not the witness; 0.17.1 must not send the env token to the collector.

The lab

Port 18099. mcp-grafana 0.17.0. SSE or streamable-http reachable. Env token set. Collector on the compose network.

Target only 127.0.0.1:18099 (or the loopback you bound).

Plain text

python3 CVE-2026-15583-Abraxas-Labs.py