Red Hat Product Security issued an advisory (RHSA-2026:19352) for Red Hat Enterprise Linux 9 that includes a security update for Grafana to fix an information disclosure vulnerability (CVE-2026-27877) involving exposure of data-source passwords through public dashboards. The advisory also addresses two additional Go-related vulnerabilities: a symlink traversal in Root.Chmod (CVE-2026-32282) and a denial of service via multiple TLS 1.3 key update messages (CVE-2026-32283). The update is available for various architectures including x86_64, s390x, ppc64le, and aarch64. The advisory references updated package versions and provides instructions for applying the update. No CVSS score is provided in the advisory.

The primary impact is the potential unauthorized disclosure of sensitive data-source passwords through publicly accessible Grafana dashboards, which could lead to compromise of connected data sources. The other two vulnerabilities could allow privilege escalation via symlink traversal and denial of service attacks on TLS connections, respectively. Red Hat classifies the overall security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Grafana packages that address these vulnerabilities. Users should apply the provided security update for Red Hat Enterprise Linux 9 as described in the Red Hat advisory (RHSA-2026:19352) and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the information disclosure and other related vulnerabilities. No additional mitigation steps are indicated by the vendor.