RHSA-2026:95012: Critical: fence-agents security update
Critical: fence-agents security update
Other sources
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266) pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268) pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271) pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267) pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/fence-agentsto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-aliyunto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-allto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-amt-wsto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-apcto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-apc-snmpto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-awsto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-azure-armto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-bladecenterto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-brocadeto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-cisco-mdsto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-cisco-ucsto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-commonto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-common-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-debugsourceto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-drac5to a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-eaton-snmpto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-emersonto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-epsto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-gceto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-heuristics-pingto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-hpbladeto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ibm-powervsto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ibm-vpcto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ibmbladeto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ifmibto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ilo-moonshotto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ilo-mpto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ilo-sshto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ilo2to a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-intelmodularto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ipduto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-ipmilanto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-kdumpto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-kdump-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-kubevirtto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-mpathto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-nutanix-ahvto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-openstackto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-redfishto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-rhevmto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-rsato a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-rsbto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-sbdto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-scsito a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-virshto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-vmware-restto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-vmware-soapto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-wtito a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virt-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtdto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-cpgto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-cpg-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-libvirtto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-libvirt-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-multicastto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-multicast-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-serialto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-serial-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-tcpto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-virtd-tcp-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/ha-cloud-supportto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/ha-cloud-support-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-zvmto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-lparto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14 - Upgrade
Upgrade
redhat/fence-agents-allto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14.aa - Upgrade
Upgrade
redhat/fence-agents-commonto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14.aa - Upgrade
Upgrade
redhat/fence-agents-common-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14.aa - Upgrade
Upgrade
redhat/fence-agents-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14.aa - Upgrade
Upgrade
redhat/fence-agents-debugsourceto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14.aa - Upgrade
Upgrade
redhat/fence-agents-kdumpto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14.aa - Upgrade
Upgrade
redhat/fence-agents-kdump-debuginfoto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14.aa - Upgrade
Upgrade
redhat/fence-agents-kubevirtto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14.aa - Upgrade
Upgrade
redhat/fence-agents-redfishto a version that resolves this vulnerability.Fixed in 4.16.0-5.el10_0.14.aa
Event History
Frequently Asked Questions
Which systems should be prioritized for remediation?
Prioritize systems that have the listed fence-agents packages installed, particularly cluster environments where these scripts are used for remote power management, restarting failed nodes, or removing unreachable nodes from a cluster.
Which packages are covered by this update?
The advisory lists fence-agents-all, fence-agents-common, fence-agents-kdump, and fence-agents-kubevirt, along with associated debuginfo and debugsource packages.
How can I determine whether a system may be affected?
Check whether any of the packages named in the advisory are installed. The provided data does not include affected or fixed package versions, so version-level exposure cannot be determined from this advisory information alone.