Red Hat Product Security issued an important security advisory (RHSA-2026:18032) for Grafana in Red Hat Enterprise Linux 10.0 EUS, addressing three vulnerabilities: CVE-2026-32282 (golang internal syscall/unix Root.Chmod following symlinks outside root), CVE-2026-32283 (Go crypto/tls denial of service via multiple TLS 1.3 key update messages), and CVE-2026-32280 (Go crypto/x509 denial of service in certificate chain building). These issues affect the Golang components used by Grafana, potentially leading to denial of service or security bypass conditions. Updated Grafana packages version 10.2.6-24.el10_0 have been released for multiple architectures to fix these vulnerabilities. The advisory references Red Hat Enterprise Linux 10.0 Extended Update Support and provides links for applying the update.

The vulnerabilities include a symlink traversal issue that could allow Root.Chmod to affect files outside the intended root directory, and denial of service vulnerabilities in TLS 1.3 key update handling and certificate chain building. These could disrupt service availability or cause unintended permission changes. No known exploits in the wild have been reported. The impact is rated as important/high by Red Hat.

Red Hat has released updated Grafana packages (version 10.2.6-24.el10_0) for Red Hat Enterprise Linux 10.0 Extended Update Support to address these vulnerabilities. Users should apply these official updates following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation actions are specified or required beyond applying the vendor-provided patches.