Red Hat Product Security released an advisory (RHSA-2026:19352) for Red Hat Enterprise Linux 9 addressing three vulnerabilities: CVE-2026-27877 in Grafana allows information disclosure of data-source passwords through public dashboards; CVE-2026-32282 in Go's internal/syscall/unix package permits Root.Chmod to follow symlinks outside the root directory; and CVE-2026-32283 in Go's crypto/tls package enables denial of service via multiple TLS 1.3 key update messages. The advisory provides updated packages for affected architectures including x86_64, s390x, ppc64le, and aarch64. The update is rated as Important by Red Hat and includes fixes for these vulnerabilities.

The Grafana vulnerability (CVE-2026-27877) can lead to unauthorized disclosure of sensitive data-source passwords if public dashboards are accessible. The Go syscall vulnerability (CVE-2026-32282) may allow privilege escalation or unauthorized file system access via symlink manipulation. The Go crypto/tls vulnerability (CVE-2026-32283) can cause denial of service conditions in TLS 1.3 connections. These issues collectively pose risks of information leakage, potential privilege misuse, and service disruption on affected Red Hat Enterprise Linux 9 systems.

Red Hat has released updated packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:19352 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation actions are indicated beyond applying the official update.