‘GrafanaGhost’ bypasses Grafana’s AI defenses without leaving a trace

Noma Security disclosed "GrafanaGhost," a high-impact vulnerability chain in Grafana that can use indirect prompt injection and a misinterpreted domain validation check to cause the platform's AI components to fetch attacker-controlled resources carrying sensitive data; Grafana released a patch after validation but disputes the claim the issue is truly zero-click or silently exploited, and no in-the-wild exploitation has been reported.