Red Hat Security Advisory: fence-agents security update

Fixed packages 135

Vulnerabilities 2

• High 8.2
  CVE-2026-26007

  cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() a…

  pyca cryptography open-webui kubeflow-pipelines-apiserver Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Feb 10, 2026
• High 7.5
  CVE-2026-32597

  PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

  PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the librar…

  jpadilla pyjwt open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Mar 12, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2438762
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447194
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21517.json
• report
  https://access.redhat.com/security/cve/CVE-2026-26007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-26007
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-26007
• article
  https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c
• article
  https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2
• report
  https://access.redhat.com/security/cve/CVE-2026-32597
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32597
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32597
• article
  https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f