RLSA-2026:94501: Critical: fence-agents security update
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)
pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/fence-agentsto a version that resolves this vulnerability.Fixed in 0:4.16.0-21.el10_2.7
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Does exploitation require authentication or user interaction?
The listed CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What security impact is indicated by the advisory?
The CVSS vector indicates high confidentiality and integrity impact, with no availability impact and unchanged scope.
Which issues are addressed by this update?
The update addresses CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272 in PyJWT, covering authentication bypass, key-validation, JWKS redirect, and token-forgery issues.