This advisory covers security fixes for Grafana packaged with Red Hat Enterprise Linux 10.0 Extended Update Support. The vulnerabilities fixed include CVE-2026-32282, where the Go internal syscall unix Root.Chmod function can follow symlinks outside the root directory, potentially leading to unauthorized file modifications. CVE-2026-32283 and CVE-2026-32280 are denial of service vulnerabilities in the Go crypto/tls package: the former via multiple TLS 1.3 key update messages and the latter in certificate chain building. These issues affect the Go runtime components used by Grafana and could cause service disruption. Red Hat has released updated packages (version 10.2.6-24.el10_0) to address these issues for multiple architectures under Red Hat Enterprise Linux 10.0 Extended Update Support.

The vulnerabilities could allow denial of service conditions in Grafana due to issues in the underlying Go crypto/tls and crypto/x509 libraries, potentially disrupting service availability. The symlink following issue could lead to unauthorized file permission changes outside intended directories. These impacts are rated as important/high severity by Red Hat, indicating significant risk to affected systems if unpatched.

Red Hat has released updated Grafana packages (version 10.2.6-24.el10_0) for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the vendor-provided patches.