The Grafana plugin for Performance Co-Pilot includes datasources and dashboards for scalable time series and live metrics. Two security issues were identified and fixed: CVE-2026-32282 involves the golang internal syscall unix Root.Chmod function improperly following symlinks outside the root directory, potentially leading to unauthorized file permission changes. CVE-2026-32283 is a denial of service vulnerability in Go's crypto/tls implementation triggered by multiple TLS 1.3 key update messages. Red Hat issued security advisories and updated packages for Red Hat Enterprise Linux 9 (up to 9.8) to remediate these vulnerabilities.

The first vulnerability (CVE-2026-32282) could allow an attacker to cause unintended file permission changes by exploiting symlink traversal in the Root.Chmod function, potentially leading to privilege escalation or unauthorized file access. The second vulnerability (CVE-2026-32283) allows denial of service attacks against services using Go's crypto/tls by sending multiple TLS 1.3 key update messages, potentially disrupting service availability. Both vulnerabilities have been rated with a security impact of Important by Red Hat.

Red Hat has released updated grafana-pcp packages that fix these vulnerabilities. Users should apply the security updates provided for Red Hat Enterprise Linux 9, specifically versions up to 9.8, as detailed in Red Hat advisories RHSA-2026:11704 and RHSA-2026:19351. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying the official patches.