Critical Security Update for grafana-pcp: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:19136: Important: grafana-pcp security update. Affects grafana-pcp versions < 5.3.0-5.el10_2. Fixed in 5.3.0-5.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot, which provides data sources for scalable time series data from pmseries and Redis. It also includes live PCP metrics and bpftrace scripts from pmdabpftrace, along with several dashboards. This package is essential for users who require real-time monitoring and visualization of performance metrics. However, it has been found to have critical vulnerabilities that could compromise system security.
Vulnerability Detail
The vulnerabilities in grafana-pcp stem from issues in the underlying Go programming language libraries. Specifically, CVE-2026-32282 allows Root.Chmod to follow symlinks out of the root, potentially leading to unauthorized file access. Additionally, CVE-2026-32283 presents a Denial of Service risk through multiple TLS 1.3 key update messages, which could disrupt secure communications. These vulnerabilities could be exploited by attackers to gain elevated privileges or disrupt service availability.
How To Fix
Minimum fixed version
5.3.0-5.el10_2
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected functionalities or disable the grafana-pcp plugin until the update is applied. This can help mitigate the risk of exploitation until the patch is installed.
Conclusion
The grafana-pcp package has critical vulnerabilities that require immediate attention. Users are advised to update to the latest patched version to ensure system security. Temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for grafana-pcp →
FAQ
Grafana-pcp is a plugin for Grafana that integrates Performance Co-Pilot metrics, allowing users to visualize and analyze performance data from various sources.
The main vulnerabilities include a potential unauthorized file access due to symlink following and a Denial of Service risk through TLS 1.3 key updates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If an immediate update is not possible, consider disabling the grafana-pcp plugin or restricting access to its functionalities as a temporary workaround.
For more details about the vulnerabilities, including their impact and CVSS scores, refer to the CVE pages listed in the related section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
