RLSA-2026:94500: Critical: fence-agents security update
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)
pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/fence-agentsto a version that resolves this vulnerability.Fixed in 0:4.10.0-110.el9_8.8
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems should be prioritized for remediation?
Prioritize Rocky Linux systems with fence-agents installed that use remote power management for cluster devices. These systems can forcibly restart and remove failed or unreachable nodes from a cluster.
What does the supplied severity vector indicate about exploitation requirements?
The supplied vector indicates network-based exploitation with low attack complexity, no required privileges, and no user interaction. It also indicates high confidentiality and integrity impact.
How can I identify systems that may need attention?
Identify Rocky Linux hosts with the fence-agents packages installed, particularly hosts participating in clusters that rely on remote power-management fencing. The advisory does not provide affected or fixed package versions, so version-based determination cannot be made from this information alone.