Summary
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
* pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
* pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)
* pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
* pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 37
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | fence-agents-aliyun | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-all | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-amt-ws | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-apc | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-apc-snmp | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-aws | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-azure-arm | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-bladecenter | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-cisco-ucs | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-common | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-compute | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-drac5 | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-gce | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-hpblade | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-ibm-powervs | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-ibm-vpc | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-ibmblade | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-ifmib | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-ilo-moonshot | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-ilo-mp | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-kdump | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-kubevirt | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-lpar | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-mpath | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-nutanix-ahv | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-openstack | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-redfish | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-rhevm | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-rsa | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-scsi | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-virsh | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-agents-vmware-rest | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-virt | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-virtd-libvirt | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-virtd-multicast | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | fence-virtd-serial | 4.10.0-110.el9_8.8 |
| AlmaLinux · 9 | ha-cloud-support | 4.10.0-110.el9_8.8 |
Vulnerabilities 5
-
Critical 9.1CVE-2026-102268 Public exploit
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…
-
High 7.4
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contain…
-
High 7.4
PyJWT: PyJWKClient follows redirects when fetching JWKS
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…
-
High 7.4
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes …
-
High 7.4
PyJWT BOM Bypass
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-102266
-
report
https://access.redhat.com/security/cve/CVE-2026-102267
-
report
https://access.redhat.com/security/cve/CVE-2026-102268
-
report
https://access.redhat.com/security/cve/CVE-2026-102271
-
report
https://access.redhat.com/security/cve/CVE-2026-102272
-
report
https://bugzilla.redhat.com/2542671
-
report
https://bugzilla.redhat.com/2542685
-
report
https://bugzilla.redhat.com/2542687
-
report
https://bugzilla.redhat.com/2542690
-
report
https://bugzilla.redhat.com/2542695
-
advisory
https://errata.almalinux.org/9/ALSA-2026-94500.html