Red Hat Product Security issued an advisory (RHSA-2026:11711) for Grafana on Red Hat Enterprise Linux 9 addressing two vulnerabilities originating from Go language libraries used by Grafana. CVE-2026-32282 involves golang's internal/syscall/unix package where the Root.Chmod function can follow symbolic links outside the intended root directory, potentially leading to unauthorized file permission changes. CVE-2026-32283 is a denial of service vulnerability in golang's crypto/tls package caused by processing multiple TLS 1.3 key update messages. Red Hat has released updated Grafana packages (version 10.2.6-21.el9_7) to fix these issues. The advisory rates the security impact as Important and provides detailed package updates for multiple architectures. No CVSS score is provided in the advisory.

The vulnerabilities could allow an attacker to cause unauthorized file permission changes by exploiting the symlink traversal issue in Root.Chmod (CVE-2026-32282) and cause denial of service conditions by sending multiple TLS 1.3 key update messages (CVE-2026-32283). These issues affect Grafana installations on Red Hat Enterprise Linux 9 and related variants. While no known exploits in the wild are reported, the impact includes potential privilege escalation or service disruption.

Red Hat has released updated Grafana packages that address these vulnerabilities. Users should apply the security update for Grafana version 10.2.6-21.el9_7 or later on Red Hat Enterprise Linux 9 and its variants as described in the Red Hat advisory RHSA-2026:11711. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying the official update.