The yggdrasil daemon, which subscribes to MQTT topics and routes data to worker processes via D-Bus, is affected by two vulnerabilities stemming from underlying golang components. CVE-2026-32282 involves the internal syscall unix Root.Chmod function improperly following symlinks outside the intended root, potentially leading to unauthorized file permission changes. CVE-2026-32283 is a denial of service vulnerability in the Go crypto/tls package triggered by multiple TLS 1.3 key update messages. Red Hat has issued security advisories and patches for these issues in Red Hat Enterprise Linux 9 and 10, including various architectures such as x86_64, s390x, ppc64le, and aarch64.

The Root.Chmod symlink issue (CVE-2026-32282) could allow unauthorized modification of file permissions outside the intended root directory, potentially impacting system integrity. The TLS denial of service vulnerability (CVE-2026-32283) could allow an attacker to disrupt TLS 1.3 connections by sending multiple key update messages, causing service interruptions. Red Hat rates the overall security impact as Important (medium severity). There are no known exploits in the wild at this time.

Red Hat has released official security updates for affected versions of Red Hat Enterprise Linux 9 and 10 that address these vulnerabilities. Users should apply the provided patches promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official updates.