Red Hat Product Security issued an advisory (RHSA-2026:19352) for Grafana and related Go components included in Red Hat Enterprise Linux 9. The primary Grafana vulnerability (CVE-2026-27877) allows information disclosure of data-source passwords through public dashboards. Two additional Go vulnerabilities are addressed: CVE-2026-32282, where Root.Chmod can follow symlinks outside the root directory, and CVE-2026-32283, a denial of service caused by multiple TLS 1.3 key update messages. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. Red Hat provides updated packages to fix these issues and rates the security impact as important.

The Grafana vulnerability (CVE-2026-27877) could lead to unauthorized disclosure of sensitive data-source passwords if public dashboards are accessible. The Go syscall vulnerability (CVE-2026-32282) may allow privilege escalation or unauthorized file system access via symlink traversal. The Go crypto/tls vulnerability (CVE-2026-32283) could cause denial of service conditions in TLS 1.3 connections. These issues collectively pose a high security risk if unpatched, potentially exposing sensitive information and disrupting services.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the provided security update (RHSA-2026:19352) promptly. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is a traditional software package, remediation requires manual update by system administrators. No indication of active exploitation is reported, but timely patching is recommended.