This advisory covers two security vulnerabilities affecting Grafana packages on Red Hat Enterprise Linux 9. The first vulnerability (CVE-2026-32282) involves the golang internal syscall unix package's Root.Chmod function, which can follow symbolic links outside the intended root directory, potentially leading to unauthorized file permission changes. The second vulnerability (CVE-2026-32283) is a denial of service issue in Go's crypto/tls package caused by processing multiple TLS 1.3 key update messages. Red Hat has issued updated Grafana packages (version 10.2.6-21.el9_7) to remediate these issues.

The Root.Chmod symlink vulnerability could allow unauthorized modification of file permissions outside the intended root, potentially leading to privilege escalation or unauthorized access. The TLS denial of service vulnerability could allow an attacker to disrupt services by sending multiple TLS 1.3 key update messages, causing resource exhaustion or service interruption. Both vulnerabilities are rated with a security impact of Important by Red Hat.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the available updates (e.g., grafana-10.2.6-21.el9_7) as described in the Red Hat advisory RHSA-2026:11711 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.