Noma Security / Grafana Labs · 2026-04-07 · major
GrafanaGhost: Indirect Prompt Injection Silently Exfiltrates Enterprise Metrics via Grafana AI
GrafanaGhost: indirect prompt injection in Grafana's AI assistant exfiltrates financial metrics and infra telemetry to an attacker server — no credentials, no user interaction, no trace. Disclosed by Noma Security; Grafana patched promptly.
A hidden prompt injection in Grafana's AI assistant leaks enterprise data silently — no phishing, no credentials, no alerts.
What is it?
GrafanaGhost is an indirect prompt injection vulnerability discovered by Noma Security in Grafana's AI assistant component. An attacker embeds a crafted payload inside data that Grafana's AI later processes (e.g., a dashboard annotation or data source value). The payload uses the keyword 'INTENT' to bypass the model's safety restrictions, then forces the Markdown image renderer to make an outbound request to an attacker-controlled server, passing sensitive data as URL query parameters.
How does it work?
The attack chains three weaknesses: (1) crafted prompts stored in Grafana context that the AI will later read, (2) a protocol-relative URL bypass (// prefix) that evades image-loading protections, and (3) the 'INTENT' keyword that causes the model to ignore its own guardrails. The result is a silent HTTP GET to the attacker's server with financial metrics, infrastructure state, or customer records embedded in the URL. Victims see no error, no alert, and no anomalous log entry.
Why does it matter?
Grafana is the de-facto monitoring platform for cloud-native infrastructure — hundreds of thousands of enterprises use it to display business KPIs, SLO dashboards, and operational telemetry. AI features added over the past year created a new attack surface: anything a Grafana AI assistant can read, an attacker can now exfiltrate by poisoning a dashboard. The attack requires no account access and leaves no trace in Grafana's own audit logs.
Who is it for?
Security engineers running Grafana in production, DevSecOps leads, enterprise CISO offices tracking AI-augmented monitoring risk
Try it
https://www.securityweek.com/grafanaghost-attackers-can-abuse-grafana-to-leak-enterprise-data/