The advisory details a high-severity vulnerability in Grafana (CVE-2026-27877) that could lead to disclosure of data-source passwords through public dashboards. It also includes fixes for two Go language vulnerabilities: a symlink traversal issue in internal/syscall/unix (CVE-2026-32282) and a denial of service via multiple TLS 1.3 key update messages in crypto/tls (CVE-2026-32283). These vulnerabilities affect Red Hat Enterprise Linux 10 and associated packages. Updated Grafana packages have been released by Red Hat to address these security flaws.

The primary impact is the potential exposure of sensitive data-source passwords through publicly accessible Grafana dashboards, which could compromise confidentiality. The Go syscall vulnerability could allow unauthorized file permission changes outside the intended root directory, and the TLS vulnerability could enable denial of service conditions. These issues collectively pose risks to system security and availability if left unpatched.

Red Hat has published updated Grafana packages for Red Hat Enterprise Linux 10 and related variants that address these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2026:19134 and the referenced article https://access.redhat.com/articles/11258. Since this is an official Red Hat security advisory with available updates, applying the official patches is the recommended remediation. Patch status is confirmed as available.