RHSA-2026:98612: Critical: fence-agents security update

Q: Which packages are covered by this advisory?

The advisory covers redhat/fence-agents-all, redhat/fence-agents-common, redhat/fence-agents-common-debuginfo, redhat/fence-agents-debuginfo, redhat/fence-agents-debugsource, redhat/fence-agents-kdump, redhat/fence-agents-kdump-debuginfo, and redhat/fence-agents-kubevirt.

Q: What authentication-related attack classes are addressed?

The fixes address authentication bypass or token forgery conditions involving empty HMAC keys, improper public-key validation, DER public keys accepted as HMAC secrets, unvalidated JWKS redirects, and Unicode byte-order mark handling.

Published Nov 11, 2026

Updated

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266) pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268) pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271) pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267) pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

95 affected componentsFixes available

redhat/fence-agents<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-aliyun<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-all<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-amt-ws<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-apc<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-apc-snmp<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-aws<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-azure-arm<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-bladecenter<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-brocade<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-cisco-mds<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-cisco-ucs<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-common<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-common-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-debugsource<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-drac5<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-eaton-snmp<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-emerson<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-eps<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-heuristics-ping<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-hpblade<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ibm-powervs<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ibm-vpc<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ibmblade<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ifmib<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ilo-moonshot<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ilo-mp<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ilo-ssh<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ilo2<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-intelmodular<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ipdu<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-ipmilan<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-kdump<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-kdump-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-kubevirt<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-mpath<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-nutanix-ahv<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-openstack<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-redfish<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-rhevm<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-rsa<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-rsb<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-sbd<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-scsi<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-virsh<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-vmware-rest<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-vmware-soap<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-wti<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virt<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virt-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-cpg<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-cpg-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-libvirt<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-libvirt-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-multicast<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-multicast-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-serial<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-serial-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-tcp<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-virtd-tcp-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/ha-cloud-support<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/ha-cloud-support-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-all<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-common<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-common-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-debugsource<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-kdump<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-kdump-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-kubevirt<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-redfish<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-zvm<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-all<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-common<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-common-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-debugsource<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-kdump<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-kdump-debuginfo<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-kubevirt<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-lpar<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-openstack<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-redfish<4.16.0-34.el10_3.1

4.16.0-34.el10_3.1

redhat/fence-agents-all<4.16.0-34.el10_3.1.aa

4.16.0-34.el10_3.1.aa

redhat/fence-agents-common<4.16.0-34.el10_3.1.aa

4.16.0-34.el10_3.1.aa

redhat/fence-agents-common-debuginfo<4.16.0-34.el10_3.1.aa

4.16.0-34.el10_3.1.aa

redhat/fence-agents-debuginfo<4.16.0-34.el10_3.1.aa

4.16.0-34.el10_3.1.aa

redhat/fence-agents-debugsource<4.16.0-34.el10_3.1.aa

4.16.0-34.el10_3.1.aa

redhat/fence-agents-kdump<4.16.0-34.el10_3.1.aa

4.16.0-34.el10_3.1.aa

redhat/fence-agents-kdump-debuginfo<4.16.0-34.el10_3.1.aa

4.16.0-34.el10_3.1.aa

redhat/fence-agents-kubevirt<4.16.0-34.el10_3.1.aa

4.16.0-34.el10_3.1.aa

redhat/fence-agents-redfish<4.16.0-34.el10_3.1.aa

4.16.0-34.el10_3.1.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/fence-agents to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-aliyun to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-all to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-amt-ws to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-apc to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-apc-snmp to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-aws to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-azure-arm to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-bladecenter to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-brocade to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-cisco-mds to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-cisco-ucs to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-common to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-common-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-debugsource to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-drac5 to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-eaton-snmp to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-emerson to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-eps to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-gce to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-heuristics-ping to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-hpblade to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ibm-powervs to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ibm-vpc to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ibmblade to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ifmib to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ilo-moonshot to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ilo-mp to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ilo-ssh to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ilo2 to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-intelmodular to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ipdu to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-ipmilan to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-kdump to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-kdump-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-kubevirt to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-mpath to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-nutanix-ahv to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-openstack to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-redfish to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-rhevm to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-rsa to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-rsb to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-sbd to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-scsi to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-virsh to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-vmware-rest to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-vmware-soap to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-wti to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virt to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virt-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-cpg to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-cpg-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-libvirt to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-libvirt-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-multicast to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-multicast-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-serial to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-serial-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-tcp to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-virtd-tcp-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/ha-cloud-support to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/ha-cloud-support-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-zvm to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-lpar to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1
Upgrade
Upgrade redhat/fence-agents-all to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1.aa
Upgrade
Upgrade redhat/fence-agents-common to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1.aa
Upgrade
Upgrade redhat/fence-agents-common-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1.aa
Upgrade
Upgrade redhat/fence-agents-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1.aa
Upgrade
Upgrade redhat/fence-agents-debugsource to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1.aa
Upgrade
Upgrade redhat/fence-agents-kdump to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1.aa
Upgrade
Upgrade redhat/fence-agents-kdump-debuginfo to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1.aa
Upgrade
Upgrade redhat/fence-agents-kubevirt to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1.aa
Upgrade
Upgrade redhat/fence-agents-redfish to a version that resolves this vulnerability.
Fixed in 4.16.0-34.el10_3.1.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which packages are covered by this advisory?

The advisory covers redhat/fence-agents-all, redhat/fence-agents-common, redhat/fence-agents-common-debuginfo, redhat/fence-agents-debuginfo, redhat/fence-agents-debugsource, redhat/fence-agents-kdump, redhat/fence-agents-kdump-debuginfo, and redhat/fence-agents-kubevirt.

What authentication-related attack classes are addressed?

The fixes address authentication bypass or token forgery conditions involving empty HMAC keys, improper public-key validation, DER public keys accepted as HMAC secrets, unvalidated JWKS redirects, and Unicode byte-order mark handling.

RHSA-2026:98612: Critical: fence-agents security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which packages are covered by this advisory?

What authentication-related attack classes are addressed?

Company

Resources

Contact