RHSA-2026:94634: Critical: fence-agents security update

Published Nov 3, 2026
·
Updated

Critical: fence-agents security update

Other sources

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266) pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268) pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271) pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267) pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat

Affected Software

24 affected components
Red Hat Red Hat Enterprise Linux for IBM z Systems - 4 years of updates
Red Hat Red Hat Enterprise Linux High Availability for ARM 64 - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle
Red Hat Red Hat Enterprise Linux Resilient Storage for IBM z Systems - Extended Life Cycle
Red Hat Red Hat Enterprise Linux High Availability for x86_64 - Extended Life Cycle
Red Hat Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux Server - AUS
Red Hat Red Hat Enterprise Linux High Availability for x86_64 - Advanced Update Support
Red Hat Red Hat Enterprise Linux High Availability for IBM z Systems - Extended Life Cycle
Red Hat Red Hat Enterprise Linux High Availability for IBM z Systems - 4 years of updates
Red Hat Red Hat Enterprise Linux Resilient Storage for Power, little endian - 4 years of updates
Red Hat Red Hat Enterprise Linux High Availability for ARM 64 - 4 years of updates
Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle
Red Hat Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux Resilient Storage for IBM z Systems - 4 years of updates
Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates
Red Hat Red Hat Enterprise Linux High Availability for Power LE - Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux Resilient Storage for x86_64 - 4 years of updates
Red Hat Red Hat Enterprise Linux Resilient Storage for Power, little endian - Extended Life Cycle
Red Hat Red Hat Enterprise Linux High Availability for Power, little endian - Extended Life Cycle
Red Hat Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Life Cycle

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/fence-agents to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  2. Upgrade

    Upgrade redhat/fence-agents-common to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  3. Upgrade

    Upgrade redhat/fence-agents-compute to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  4. Upgrade

    Upgrade redhat/fence-agents-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  5. Upgrade

    Upgrade redhat/fence-agents-debugsource to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  6. Upgrade

    Upgrade redhat/fence-agents-ibm-powervs to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  7. Upgrade

    Upgrade redhat/fence-agents-ibm-vpc to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  8. Upgrade

    Upgrade redhat/fence-agents-kdump-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  9. Upgrade

    Upgrade redhat/fence-agents-kubevirt to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  10. Upgrade

    Upgrade redhat/fence-agents-kubevirt-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  11. Upgrade

    Upgrade redhat/fence-agents-virsh to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  12. Upgrade

    Upgrade redhat/fence-virt to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  13. Upgrade

    Upgrade redhat/fence-virt-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  14. Upgrade

    Upgrade redhat/fence-virtd to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  15. Upgrade

    Upgrade redhat/fence-virtd-cpg to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  16. Upgrade

    Upgrade redhat/fence-virtd-cpg-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  17. Upgrade

    Upgrade redhat/fence-virtd-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  18. Upgrade

    Upgrade redhat/fence-virtd-libvirt to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  19. Upgrade

    Upgrade redhat/fence-virtd-libvirt-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  20. Upgrade

    Upgrade redhat/fence-virtd-multicast to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  21. Upgrade

    Upgrade redhat/fence-virtd-multicast-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  22. Upgrade

    Upgrade redhat/fence-virtd-serial to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  23. Upgrade

    Upgrade redhat/fence-virtd-serial-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  24. Upgrade

    Upgrade redhat/fence-virtd-tcp to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  25. Upgrade

    Upgrade redhat/fence-virtd-tcp-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  26. Upgrade

    Upgrade redhat/ha-cloud-support-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  27. Upgrade

    Upgrade redhat/fence-agents-all to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  28. Upgrade

    Upgrade redhat/fence-agents-amt-ws to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  29. Upgrade

    Upgrade redhat/fence-agents-apc to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  30. Upgrade

    Upgrade redhat/fence-agents-apc-snmp to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  31. Upgrade

    Upgrade redhat/fence-agents-bladecenter to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  32. Upgrade

    Upgrade redhat/fence-agents-brocade to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  33. Upgrade

    Upgrade redhat/fence-agents-cisco-mds to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  34. Upgrade

    Upgrade redhat/fence-agents-cisco-ucs to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  35. Upgrade

    Upgrade redhat/fence-agents-drac5 to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  36. Upgrade

    Upgrade redhat/fence-agents-eaton-snmp to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  37. Upgrade

    Upgrade redhat/fence-agents-emerson to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  38. Upgrade

    Upgrade redhat/fence-agents-eps to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  39. Upgrade

    Upgrade redhat/fence-agents-heuristics-ping to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  40. Upgrade

    Upgrade redhat/fence-agents-hpblade to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  41. Upgrade

    Upgrade redhat/fence-agents-ibmblade to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  42. Upgrade

    Upgrade redhat/fence-agents-ifmib to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  43. Upgrade

    Upgrade redhat/fence-agents-ilo-moonshot to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  44. Upgrade

    Upgrade redhat/fence-agents-ilo-mp to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  45. Upgrade

    Upgrade redhat/fence-agents-ilo-ssh to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  46. Upgrade

    Upgrade redhat/fence-agents-ilo2 to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  47. Upgrade

    Upgrade redhat/fence-agents-intelmodular to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  48. Upgrade

    Upgrade redhat/fence-agents-ipdu to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  49. Upgrade

    Upgrade redhat/fence-agents-ipmilan to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  50. Upgrade

    Upgrade redhat/fence-agents-kdump to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  51. Upgrade

    Upgrade redhat/fence-agents-lpar to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  52. Upgrade

    Upgrade redhat/fence-agents-mpath to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  53. Upgrade

    Upgrade redhat/fence-agents-nutanix-ahv to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  54. Upgrade

    Upgrade redhat/fence-agents-openstack to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  55. Upgrade

    Upgrade redhat/fence-agents-redfish to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  56. Upgrade

    Upgrade redhat/fence-agents-rhevm to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  57. Upgrade

    Upgrade redhat/fence-agents-rsa to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  58. Upgrade

    Upgrade redhat/fence-agents-rsb to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  59. Upgrade

    Upgrade redhat/fence-agents-sbd to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  60. Upgrade

    Upgrade redhat/fence-agents-scsi to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  61. Upgrade

    Upgrade redhat/fence-agents-vmware-rest to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  62. Upgrade

    Upgrade redhat/fence-agents-vmware-soap to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  63. Upgrade

    Upgrade redhat/fence-agents-wti to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  64. Upgrade

    Upgrade redhat/ha-cloud-support to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  65. Upgrade

    Upgrade redhat/fence-agents-aliyun to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  66. Upgrade

    Upgrade redhat/fence-agents-aws to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  67. Upgrade

    Upgrade redhat/fence-agents-azure-arm to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  68. Upgrade

    Upgrade redhat/fence-agents-gce to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27
  69. Upgrade

    Upgrade redhat/fence-agents-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27.aa
  70. Upgrade

    Upgrade redhat/fence-agents-debugsource to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27.aa
  71. Upgrade

    Upgrade redhat/fence-agents-kdump-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27.aa
  72. Upgrade

    Upgrade redhat/fence-agents-kubevirt to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27.aa
  73. Upgrade

    Upgrade redhat/fence-agents-kubevirt-debuginfo to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27.aa
  74. Upgrade

    Upgrade redhat/fence-agents-all to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27.aa
  75. Upgrade

    Upgrade redhat/fence-agents-kdump to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27.aa
  76. Upgrade

    Upgrade redhat/fence-agents-redfish to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27.aa
  77. Upgrade

    Upgrade redhat/fence-agents-zvm to a version that resolves this vulnerability.

    Fixed in 4.10.0-43.el9_2.27

Event History

Nov 3, 2026
Advisory Published
via Red Hat·12:00 AM
Data Sourced
via Red Hat·12:00 AM
RemedyDescriptionAffected Software
Advisory Published
via Red Hat·06:34 PM
Data Sourced
via Red Hat·06:34 PM
Severity

Frequently Asked Questions

1

Which Red Hat offerings are listed as affected by this update?

The advisory lists multiple RHEL variants and add-ons, including IBM z Systems, ARM 64 High Availability, Power little endian, Resilient Storage, x86_64 High Availability, Power LE SAP Update Services, and RHEL Server AUS offerings. The supplied data does not identify specific package versions or release streams.

2

Does the available advisory data identify the vulnerability, attack prerequisites, or temporary mitigations?

No. The supplied data provides only the advisory classification, affected software names, and publication date; it does not provide CVE identifiers, exploitation conditions, default-configuration impact, or mitigations.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203