Red Hat Product Security issued an important security advisory (RHSA-2026:11507) for Grafana on Red Hat Enterprise Linux 8, addressing three vulnerabilities originating from Go language components used by Grafana. CVE-2026-32282 involves a flaw in golang's internal/syscall/unix package where Root.Chmod can follow symlinks outside the intended root directory, potentially leading to unauthorized file permission changes. CVE-2026-32283 and CVE-2026-32280 are denial of service vulnerabilities in Go's crypto/tls and crypto/x509 packages, respectively, involving TLS 1.3 key update message handling and certificate chain building. The advisory provides updated Grafana packages (version 9.2.10-30.el8_10) for multiple architectures to fix these issues. No CVSS scores are provided in the advisory; users are directed to the CVE pages for detailed scoring. No known exploits in the wild have been reported at this time.

The vulnerabilities could allow an attacker to cause denial of service conditions in Grafana by exploiting flaws in TLS key update message processing and certificate chain building. Additionally, the symlink traversal issue could allow unauthorized modification of file permissions outside the intended root directory, potentially leading to privilege escalation or unauthorized access. These impacts affect the confidentiality, integrity, and availability of affected systems running vulnerable Grafana versions on Red Hat Enterprise Linux 8.

Red Hat has released updated Grafana packages (version 9.2.10-30.el8_10) for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual patching by system administrators. No indication of 'no action required' or 'already mitigated' is present, so patching is recommended.