Red Hat Security Advisory: fence-agents security update

Fixed packages 69

Vulnerabilities 5

• Critical 9.1
  CVE-2026-102268 Public exploit

  PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102266

  PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contain…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102267

  PyJWT: PyJWKClient follows redirects when fetching JWKS

  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102271

  PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

  PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes …

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102272

  PyJWT BOM Bypass

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542671
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542685
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542687
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542690
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542695
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98503.json
• report
  https://access.redhat.com/security/cve/CVE-2026-102266
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102266
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102266
• article
  https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c
• article
  https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
• article
  https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r
• report
  https://access.redhat.com/security/cve/CVE-2026-102267
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102267
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102267
• article
  https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56
• article
  https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj
• report
  https://access.redhat.com/security/cve/CVE-2026-102268
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102268
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102268
• article
  https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07
• article
  https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9
• report
  https://access.redhat.com/security/cve/CVE-2026-102271
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102271
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102271
• article
  https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499
• article
  https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773
• report
  https://access.redhat.com/security/cve/CVE-2026-102272
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102272
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102272
• article
  https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291
• article
  https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947