The Grafana plugin for Performance Co-Pilot includes datasources and dashboards for monitoring scalable time series and live PCP metrics. Two security flaws were identified: CVE-2026-32282 involves a golang internal syscall (Root.Chmod) that improperly follows symbolic links outside the root directory, potentially leading to unauthorized file system modifications. CVE-2026-32283 is a denial of service vulnerability in Go's crypto/tls implementation triggered by multiple TLS 1.3 key update messages. Red Hat has issued an important security advisory (RHSA-2026:11704) with updated grafana-pcp packages for Red Hat Enterprise Linux 9 to remediate these issues.

The first vulnerability (CVE-2026-32282) could allow unauthorized file permission changes outside the intended root directory due to symlink traversal, potentially leading to privilege escalation or unauthorized system modifications. The second vulnerability (CVE-2026-32283) can cause denial of service by exploiting the TLS 1.3 key update mechanism, potentially disrupting secure communications. Both vulnerabilities are rated with an important security impact by Red Hat, indicating significant risk if unpatched.

Red Hat has released updated grafana-pcp packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:11704 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the official patch. Patch status is confirmed as available from Red Hat.