Loading story…
Researchers at Noma Security disclosed GrafanaGhost, a vulnerability in Grafana that allowed attackers to silently exfiltrate sensitive data by abusing the platform’s AI-assisted processing of user-controlled input. The attack required no credentials or user interaction and began with a crafted external URL path or query parameter that exploited weaknesses in domain validation, AI guardrails, and content security controls. Noma said the chain could make Grafana treat attacker-controlled external resources as trusted and send sensitive operational, financial, infrastructure, or customer data to an attacker-controlled server, including through image requests.
Grafana Labs validated the findings after responsible disclosure and released a fix. Researchers said the attack was especially concerning because the malicious behavior could appear as normal AI activity and evade traditional monitoring, highlighting how indirect prompt injection can bypass multiple defensive layers in enterprise platforms. Industry reaction underscored both the growing risk from AI-specific attack surfaces and the debate over practical exploitability in hardened deployments with stronger network controls.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Noma Security publicly disclosed GrafanaGhost, describing how indirect prompt injection, crafted external URL paths or query parameters, and protocol-relative URL handling could be chained to make Grafana send sensitive data to an attacker-controlled server.
Grafana Labs issued a fix to address the validated GrafanaGhost vulnerability, which involved weaknesses in areas including domain validation, AI guardrails, and content security controls.
After Noma Security reported the findings through responsible disclosure, Grafana Labs confirmed the vulnerability affecting Grafana's AI-related processing and defensive controls.
Noma Security identified a vulnerability chain in Grafana, later dubbed GrafanaGhost, that abuses AI-assisted processing of user-controlled input to bypass multiple defenses and exfiltrate sensitive data without credentials or user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcehackread.com
Open sourcecyberscoop.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
On September 28, 2025, a significant surge in exploitation attempts targeting the Grafana path traversal vulnerability, CVE-2021-43798, was detected by GreyNoise. This vulnerability allows attackers to perform arbitrary file reads on vulnerable Grafana instances, posing a serious risk to organizations using the affected software. Over the course of a single day, GreyNoise observed 110 unique IP addresses attempting to exploit this flaw, all of which were classified as malicious. The majority of these IPs originated from Bangladesh, with 107 IPs traced to that country, while the remaining sources included China and Germany. Of the Bangladesh-based IPs, 105 specifically targeted endpoints in the United States, indicating a focused attack pattern. The destinations of the attacks were limited to three countries: the United States, Slovakia, and Taiwan, with the U.S. being the primary target. The attack traffic followed a consistent ratio across these countries, approximately 3:1:1 for the U.S., Slovakia, and Taiwan, respectively. Analysis of the TCP and HTTP fingerprints revealed that multiple tools were used in the attacks, but all were directed at the same set of targets, suggesting a coordinated campaign rather than random, opportunistic exploitation. Two notable IP addresses from China, both belonging to CHINANET-BACKBONE, were highlighted for their activity on the day of the surge. These IPs were only active on September 28 and were not observed before or after this date, further supporting the theory of a coordinated, time-bound operation. The exploitation activity had been relatively quiet in the months leading up to this event, making the sudden spike particularly noteworthy. GreyNoise's Global Observation Grid (GOG) was instrumental in detecting and analyzing the surge, providing valuable intelligence on the geographic and technical characteristics of the attack. The convergence of attack patterns, source geographies, and tooling points to shared tasking or a common target list among the attackers. Organizations using Grafana are advised to ensure that their systems are patched against CVE-2021-43798 and to monitor for suspicious activity from the identified malicious IPs. The incident underscores the ongoing threat posed by unpatched vulnerabilities in widely used open-source software. Security teams should remain vigilant for similar coordinated exploitation attempts, especially following periods of low activity. The rapid mobilization of a large number of malicious IPs in a single day demonstrates the attackers' ability to coordinate and execute targeted campaigns efficiently. This event highlights the importance of global threat intelligence sharing and proactive vulnerability management. The attack serves as a reminder that even older vulnerabilities can become the focus of renewed exploitation efforts. Organizations should review their exposure to Grafana and implement appropriate network defenses to mitigate the risk of similar attacks.
Jul 23, 2026
Grafana issued urgent patches for two high-severity vulnerabilities, including **`CVE-2026-27876`**, a critical flaw in the SQL Expressions feature that can allow an attacker with **Viewer** privileges or higher to write arbitrary files to the server and potentially escalate to full **remote code execution**. The issue can be chained into broader compromise scenarios, including unauthorized SSH access, prompting public warnings from national defenders such as Belgium’s CCB to patch immediately. Grafana also fixed **`CVE-2026-27880`**, which affects OpenFeature validation endpoints and allows **unauthenticated** attackers to crash vulnerable instances by sending oversized requests that exhaust memory. Grafana Labs said patched releases, including **12.4.2**, are available and noted that **Amazon Managed Grafana** and **Azure Managed Grafana** were already protected under embargo; for temporary mitigation, administrators were advised to disable the `sqlExpressions` feature toggle and use highly available deployments and reverse proxies such as **Nginx** or **Cloudflare** to restrict request sizes.
Jun 29, 2026
A newly disclosed server-side request forgery flaw, **CVE-2026-19516**, affects **Grafana MCP Server** and **mcp-grafana** in versions **prior to or equal to `1.0.0`**. The vulnerability allows a caller-controlled `X-Grafana-URL` header to steer outbound requests to attacker-chosen destinations, while the `grafana_api_request` tool lets the caller select the HTTP method, path, and body. That combination can be abused to reach internal, loopback, and link-local services, including cloud metadata endpoints, and read back the responses. The issue remains exploitable despite an earlier fix for **CVE-2026-15583**, which prevented the configured Grafana service-account token from being sent to unintended destinations but did not restrict where requests could be sent. The **Canadian Centre for Cyber Security** issued advisory **AV26-796**, warning that Grafana products are affected and urging administrators to review vendor guidance and apply updates when available.
Aug 14, 2026