Red Hat Security Advisory: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot (grafana-pcp) in Red Hat Enterprise Linux 9.4 includes datasources and dashboards for time series and metrics. A security flaw in the golang crypto/x509 package (CVE-2026-111943) allows man-in-the-middle attacks through acceptance of untrusted intermediate certificates. Red Hat has issued an important security advisory (RHSA-2026:86972) with updated grafana-pcp packages that resolve this vulnerability. The advisory covers multiple RHEL 9.4 variants and architectures including x86_64, ppc64le, aarch64, and s390x. No CVSS score is provided in the advisory, but the severity is rated as important.

The vulnerability enables man-in-the-middle attacks by exploiting improper validation of intermediate certificates in TLS connections. This could allow attackers to intercept or tamper with encrypted communications that rely on the affected crypto/x509 implementation within the grafana-pcp plugin. The impact is significant for environments using this plugin for monitoring and metrics visualization.

Red Hat has released updated grafana-pcp packages for Red Hat Enterprise Linux 9.4 that fix this vulnerability. Users should apply these official updates as described in the Red Hat advisory (RHSA-2026:86972) and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.