Grafana MCP X-Grafana-URL header used to exfiltrate service-account token to external host (CVE-2026-15583)

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•2

Detects anomalous use of the 'X-Grafana-URL' header in conjunction with an 'Authorization: Bearer' token, indicative of an attempt to exfiltrate a service account token to an unauthorized or external domain, exploiting CVE-2026-15583.