Red Hat Product Security issued an advisory for Grafana in Red Hat Enterprise Linux 10.0 EUS addressing three vulnerabilities originating from Go language components. CVE-2026-32282 involves a flaw in golang's internal syscall/unix package where Root.Chmod can follow symlinks outside the root directory. CVE-2026-32283 and CVE-2026-32280 are denial of service vulnerabilities in Go's crypto/tls and crypto/x509 packages, respectively, related to TLS 1.3 key update messages and certificate chain building. These vulnerabilities have been fixed in updated Grafana packages provided by Red Hat. The advisory includes detailed package versions and SHA-256 checksums for verification.

Successful exploitation of CVE-2026-32282 could allow unintended file permission changes via symlink traversal, potentially leading to privilege escalation or unauthorized file modifications. CVE-2026-32283 and CVE-2026-32280 could allow denial of service conditions by sending multiple TLS 1.3 key update messages or exploiting certificate chain building flaws, potentially disrupting service availability. No known exploits in the wild have been reported. The overall security impact is rated as Important by Red Hat.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the provided security update as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these issues. Since this is an on-premises product, patching is required by system administrators. No additional mitigation steps are indicated by the vendor advisory.