Summary
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
* pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
* pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)
* pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
* pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 95
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | fence-agents-aliyun | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-all | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-all | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-all | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-all | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-amt-ws | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-apc | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-apc-snmp | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-aws | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-azure-arm | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-bladecenter | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-brocade | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-cisco-mds | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-cisco-ucs | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-common | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-compute | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-compute | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-debugsource | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-debugsource | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-debugsource | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-debugsource | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-drac5 | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-eaton-snmp | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-emerson | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-eps | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-gce | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-heuristics-ping | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-hpblade | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ibm-powervs | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ibm-vpc | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ibmblade | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ifmib | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ilo-moonshot | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ilo-mp | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ilo-ssh | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ilo2 | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-intelmodular | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ipdu | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-ipmilan | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kdump | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kdump | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kdump | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kdump | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kdump-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kdump-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kdump-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kdump-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kubevirt | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kubevirt | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kubevirt | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kubevirt | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kubevirt-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kubevirt-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kubevirt-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-kubevirt-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-lpar | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-mpath | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-nutanix-ahv | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-openstack | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-openstack | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-redfish | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-redfish | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-redfish | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-redfish | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-rhevm | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-rsa | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-rsb | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-sbd | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-scsi | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-virsh | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-vmware-rest | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-vmware-soap | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-wti | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-agents-zvm | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virt | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virt-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-cpg | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-cpg-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-libvirt | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-libvirt-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-multicast | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-multicast-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-serial | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-serial-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-tcp | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | fence-virtd-tcp-debuginfo | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | ha-cloud-support | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | ha-cloud-support | 0:4.10.0-122.el9_9.1 |
| Rocky Linux · 9 | ha-cloud-support-debuginfo | 0:4.10.0-122.el9_9.1 |
Vulnerabilities 5
-
Critical 9.1CVE-2026-102268 Public exploit
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…
-
High 7.4
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contain…
-
High 7.4
PyJWT: PyJWKClient follows redirects when fetching JWKS
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…
-
High 7.4
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes …
-
High 7.4
PyJWT BOM Bypass
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542671
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542685
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542687
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542690
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542695
-
advisory
https://access.redhat.com/errata/RHSA-2026:98503