Critical Security Update for grafana-pcp: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:19351: Important: grafana-pcp security update. Affects grafana-pcp versions < 5.1.1-15.el9_8. Fixed in 5.1.1-15.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot (PCP), which facilitates the collection and visualization of performance metrics from various sources, including pmseries and Redis. This plugin provides users with scalable time series data, live metrics, and dashboards to monitor system performance effectively. However, recent security vulnerabilities have been identified that could potentially compromise the integrity and availability of the system.
Vulnerability Detail
The vulnerabilities stem from two main issues: First, a flaw in the golang internal syscall that allows Root.Chmod to follow symlinks out of the root, which could lead to unauthorized access or modification of files (CVE-2026-32282). Second, a Denial of Service vulnerability in the Go crypto/tls library, where multiple TLS 1.3 key update messages can overwhelm the system, causing service disruptions (CVE-2026-32283). These vulnerabilities pose significant risks, including potential data breaches and service outages.
How To Fix
Minimum fixed version
5.1.1-15.el9_8
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, consider restricting access to the affected components of the grafana-pcp plugin until the update can be applied. This may involve adjusting user permissions or disabling specific features that utilize the vulnerable functionalities.
Conclusion
In summary, the grafana-pcp package has critical vulnerabilities that require immediate attention. Users are advised to update to the latest patched version to mitigate risks associated with unauthorized access and service disruptions. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for grafana-pcp →
FAQ
grafana-pcp is a plugin for Grafana that allows users to visualize performance metrics collected from various sources, enhancing monitoring capabilities.
The vulnerabilities include a symlink following issue in golang's internal syscall and a Denial of Service vulnerability in the Go crypto/tls library.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
These vulnerabilities can lead to unauthorized file access and Denial of Service attacks, which may disrupt service availability and compromise data integrity.
Yes, a patch is available in the form of an updated version of the grafana-pcp package, specifically version 5.1.1-15.el9_8.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
