Case grafanaghostPrompt injectionWorldwide
GrafanaGhost: indirect prompt injection makes Grafana AI leak enterprise data
Researchers showed hidden instructions in external content could make Grafana's AI render an attacker image URL carrying enterprise data; Grafana patched it.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 7, 2026
- Location
- Worldwide
- Target
- Grafana AI assistant
- Severity
- Medium
- Triggered by
- Security researchers at Noma Security (Sasi Levi), responsible disclosure
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Researchers showed hidden instructions in external content could make Grafana's AI render an attacker image URL carrying enterprise data; Grafana patched it.
Impact: Proof of concept only; no confirmed data breach. Attack could have leaked dashboard data including financial metrics, infrastructure and customer telemetry to an attacker server
Who triggered it
Actor: Security researchers at Noma Security (Sasi Levi), responsible disclosure
Attribution: Self-attributed research by Noma Security; Grafana Labs validated the flaw but disputed its severity
Motive: Security research and responsible disclosure
How it happened
Attack vector: Crafted URL path carrying hidden instructions, an INTENT keyword to bypass guardrails, and a protocol-relative image URL that evaded external-image domain validation
Root cause: Grafana AI assistant trusted content in URL paths and external pages, and URL validation failed to block protocol-relative links, enabling zero-click exfiltration via image rendering
Timeline
- Noma Security discovers the chained bypass and reports it to Grafana Labs
- Grafana patches the core issue; Noma publishes GrafanaGhost research
- SecurityWeek, CyberScoop and Dark Reading cover the disclosure
Response
Grafana Labs validated the report and rolled out a fix for the URL validation and guardrail bypass; disputed the severity, noting repeated user involvement was needed
Current status: Patched
Sources (open in a new tab)
- SecurityWeek securityweek.com
- CyberScoop cyberscoop.com
- Dark Reading darkreading.com
- CSO Online csoonline.com
Cite this case
GrafanaGhost: indirect prompt injection makes Grafana AI leak enterprise data. AI Threat Watch, case grafanaghost, Apr 7, 2026. https://aithreat.io/cases/grafanaghost/
Permanent link: https://aithreat.io/cases/grafanaghost/