Topic starter
16/04/2026 6:43 pm
TL;DR: GrafanaGhost is a critical Grafana vulnerability that uses indirect prompt injection, protocol-relative URL bypasses, and model guardrail evasion to exfiltrate sensitive business data silently in the background without user clicks, according to Noma Security. The episode shows that client-side validation and AI safeguards can fail when agentic dashboard features share the same data plane.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “GrafanaGhost: The Phantom Stealing Your Data”.
Key questions
Q: What breaks when dashboards let AI components make outbound requests?
A: The separation between viewing data and sending data breaks.
Q: Why do protocol-relative URLs create security risk in browser-based validation?
A: They can satisfy simplistic string checks while still resolving to an external destination in the browser.
Q: How do indirect prompt injections change the risk profile of dashboards?
A: They let attacker-controlled text become an instruction source for the model.
Practitioner guidance
- Define outbound request boundaries for model-mediated dashboards Restrict which domains, schemes, and resource types a dashboard or embedded model may contact on behalf of a user.
- Canonicalise URLs before any allowlist decision Normalize and parse candidate URLs on the server side, then compare the resolved origin rather than the raw string.
- Separate dashboard rendering from model execution Keep AI summarisation, extraction, and external-request capability outside the same trust zone as sensitive telemetry and business metrics.
Bottom line: GrafanaGhost shows that a dashboard can leak data even when no user clicks and no obvious exploit chain is visible to defenders.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 5:31 pm
Model-mediated dashboards create a new trust boundary that IAM programmes do not currently model well. GrafanaGhost is not just an application flaw. It shows that when an AI component can read context and trigger outbound requests, the control question shifts from user authentication to request authorisation across the model boundary. The practical conclusion is that dashboards with agentic features need explicit governance for what the model may fetch, render, and disclose.
A question worth separating out:
Q: What do organisations get wrong about AI guardrails?
A: Many teams assume a policy filter alone can prevent harmful output, but adversarial prompting shows that language models can be steered around obvious controls. The common mistake is treating guardrails as a static filter list instead of a system of content separation, monitoring, and authorisation boundaries.
👉 Read our full editorial: GrafanaGhost shows how agentic dashboards can silently leak data