The Grafana plugin for Performance Co-Pilot includes datasources and dashboards for scalable time series and live metrics. Two security flaws have been identified and fixed: CVE-2026-32282 involves the golang internal syscall unix Root.Chmod function improperly following symlinks outside the root directory, potentially leading to unauthorized file permission changes. CVE-2026-32283 is a denial of service vulnerability in Go's crypto/tls package triggered by multiple TLS 1.3 key update messages. Red Hat has issued an update for grafana-pcp in Red Hat Enterprise Linux 10 to address these vulnerabilities.

These vulnerabilities could allow unauthorized file permission changes via symlink traversal (CVE-2026-32282) and denial of service attacks through TLS 1.3 key update message abuse (CVE-2026-32283). Red Hat rates the security impact as Important, indicating a high severity but not critical. There are no known exploits in the wild at this time.

Red Hat has released an official security update for grafana-pcp in Red Hat Enterprise Linux 10 to remediate these vulnerabilities. Users should apply the update as detailed in Red Hat advisory RHSA-2026:19136 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patch.