This advisory covers three security vulnerabilities affecting Grafana packages distributed with Red Hat Enterprise Linux 8. The first vulnerability (CVE-2026-32282) involves the Go internal syscall unix package's Root.Chmod function, which can follow symlinks outside the intended root directory, potentially leading to unauthorized file permission changes. The second (CVE-2026-32283) and third (CVE-2026-32280) vulnerabilities are denial of service issues in Go's crypto/tls and crypto/x509 packages, respectively, involving TLS 1.3 key update messages and certificate chain building. Red Hat has released updated Grafana packages (version 9.2.10-30.el8_10) for multiple architectures to address these issues.

Successful exploitation of CVE-2026-32282 could allow unauthorized modification of file permissions outside the intended root directory due to symlink traversal. CVE-2026-32283 and CVE-2026-32280 could allow denial of service conditions in applications using the affected Go crypto libraries, potentially disrupting TLS communications or certificate validation processes. The overall impact is rated as Important by Red Hat, indicating a significant security concern but not critical.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the provided security update (grafana-9.2.10-30.el8_10) from the Red Hat repositories as soon as possible. For detailed instructions on applying the update, refer to the Red Hat advisory article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.