RLSA-2026:98503: Critical: fence-agents security update

Published Nov 13, 2026
·
Updated

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es):

pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)

pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)

pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)

pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

67 affected componentsFixes available
rocky-linux/fence-agents-aliyun<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-all<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-aws<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-azure-arm<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-compute<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-debugsource<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-gce<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-kdump<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-kdump-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-kubevirt<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-kubevirt-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-redfish<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virt<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-cpg<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-cpg-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virt-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-libvirt<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-libvirt-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-multicast<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-multicast-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-serial<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-serial-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-tcp<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-virtd-tcp-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/ha-cloud-support<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/ha-cloud-support-debuginfo<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-zvm<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-amt-ws<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-apc<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-apc-snmp<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-bladecenter<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-brocade<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-cisco-mds<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-cisco-ucs<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-common<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-drac5<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-eaton-snmp<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-emerson<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-eps<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-heuristics-ping<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-hpblade<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ibmblade<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ibm-powervs<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ibm-vpc<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ifmib<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ilo2<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ilo-moonshot<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ilo-mp<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ilo-ssh<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-intelmodular<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ipdu<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-ipmilan<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-lpar<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-mpath<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-nutanix-ahv<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-rhevm<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-rsa<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-rsb<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-sbd<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-scsi<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-virsh<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-vmware-rest<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-vmware-soap<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1
rocky-linux/fence-agents-wti<0:4.10.0-122.el9_9.1
0:4.10.0-122.el9_9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade rocky-linux/fence-agents-aliyun to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  2. Upgrade

    Upgrade rocky-linux/fence-agents-all to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  3. Upgrade

    Upgrade rocky-linux/fence-agents-aws to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  4. Upgrade

    Upgrade rocky-linux/fence-agents-azure-arm to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  5. Upgrade

    Upgrade rocky-linux/fence-agents-compute to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  6. Upgrade

    Upgrade rocky-linux/fence-agents-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  7. Upgrade

    Upgrade rocky-linux/fence-agents-debugsource to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  8. Upgrade

    Upgrade rocky-linux/fence-agents-gce to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  9. Upgrade

    Upgrade rocky-linux/fence-agents-kdump to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  10. Upgrade

    Upgrade rocky-linux/fence-agents-kdump-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  11. Upgrade

    Upgrade rocky-linux/fence-agents-kubevirt to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  12. Upgrade

    Upgrade rocky-linux/fence-agents-kubevirt-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  13. Upgrade

    Upgrade rocky-linux/fence-agents-openstack to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  14. Upgrade

    Upgrade rocky-linux/fence-agents-redfish to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  15. Upgrade

    Upgrade rocky-linux/fence-virt to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  16. Upgrade

    Upgrade rocky-linux/fence-virtd to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  17. Upgrade

    Upgrade rocky-linux/fence-virtd-cpg to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  18. Upgrade

    Upgrade rocky-linux/fence-virtd-cpg-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  19. Upgrade

    Upgrade rocky-linux/fence-virtd-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  20. Upgrade

    Upgrade rocky-linux/fence-virt-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  21. Upgrade

    Upgrade rocky-linux/fence-virtd-libvirt to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  22. Upgrade

    Upgrade rocky-linux/fence-virtd-libvirt-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  23. Upgrade

    Upgrade rocky-linux/fence-virtd-multicast to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  24. Upgrade

    Upgrade rocky-linux/fence-virtd-multicast-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  25. Upgrade

    Upgrade rocky-linux/fence-virtd-serial to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  26. Upgrade

    Upgrade rocky-linux/fence-virtd-serial-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  27. Upgrade

    Upgrade rocky-linux/fence-virtd-tcp to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  28. Upgrade

    Upgrade rocky-linux/fence-virtd-tcp-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  29. Upgrade

    Upgrade rocky-linux/ha-cloud-support to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  30. Upgrade

    Upgrade rocky-linux/ha-cloud-support-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  31. Upgrade

    Upgrade rocky-linux/fence-agents-zvm to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  32. Upgrade

    Upgrade rocky-linux/fence-agents-amt-ws to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  33. Upgrade

    Upgrade rocky-linux/fence-agents-apc to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  34. Upgrade

    Upgrade rocky-linux/fence-agents-apc-snmp to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  35. Upgrade

    Upgrade rocky-linux/fence-agents-bladecenter to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  36. Upgrade

    Upgrade rocky-linux/fence-agents-brocade to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  37. Upgrade

    Upgrade rocky-linux/fence-agents-cisco-mds to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  38. Upgrade

    Upgrade rocky-linux/fence-agents-cisco-ucs to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  39. Upgrade

    Upgrade rocky-linux/fence-agents-common to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  40. Upgrade

    Upgrade rocky-linux/fence-agents-drac5 to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  41. Upgrade

    Upgrade rocky-linux/fence-agents-eaton-snmp to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  42. Upgrade

    Upgrade rocky-linux/fence-agents-emerson to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  43. Upgrade

    Upgrade rocky-linux/fence-agents-eps to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  44. Upgrade

    Upgrade rocky-linux/fence-agents-heuristics-ping to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  45. Upgrade

    Upgrade rocky-linux/fence-agents-hpblade to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  46. Upgrade

    Upgrade rocky-linux/fence-agents-ibmblade to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  47. Upgrade

    Upgrade rocky-linux/fence-agents-ibm-powervs to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  48. Upgrade

    Upgrade rocky-linux/fence-agents-ibm-vpc to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  49. Upgrade

    Upgrade rocky-linux/fence-agents-ifmib to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  50. Upgrade

    Upgrade rocky-linux/fence-agents-ilo2 to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  51. Upgrade

    Upgrade rocky-linux/fence-agents-ilo-moonshot to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  52. Upgrade

    Upgrade rocky-linux/fence-agents-ilo-mp to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  53. Upgrade

    Upgrade rocky-linux/fence-agents-ilo-ssh to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  54. Upgrade

    Upgrade rocky-linux/fence-agents-intelmodular to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  55. Upgrade

    Upgrade rocky-linux/fence-agents-ipdu to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  56. Upgrade

    Upgrade rocky-linux/fence-agents-ipmilan to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  57. Upgrade

    Upgrade rocky-linux/fence-agents-lpar to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  58. Upgrade

    Upgrade rocky-linux/fence-agents-mpath to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  59. Upgrade

    Upgrade rocky-linux/fence-agents-nutanix-ahv to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  60. Upgrade

    Upgrade rocky-linux/fence-agents-rhevm to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  61. Upgrade

    Upgrade rocky-linux/fence-agents-rsa to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  62. Upgrade

    Upgrade rocky-linux/fence-agents-rsb to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  63. Upgrade

    Upgrade rocky-linux/fence-agents-sbd to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  64. Upgrade

    Upgrade rocky-linux/fence-agents-scsi to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  65. Upgrade

    Upgrade rocky-linux/fence-agents-virsh to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  66. Upgrade

    Upgrade rocky-linux/fence-agents-vmware-rest to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  67. Upgrade

    Upgrade rocky-linux/fence-agents-vmware-soap to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1
  68. Upgrade

    Upgrade rocky-linux/fence-agents-wti to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-122.el9_9.1

Event History

Nov 13, 2026
Advisory Published
via OSV·12:04 PM
Data Sourced
via OSV·12:04 PM
DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

Which components are covered by this update?

The update covers Rocky Linux fence-agents packages including fence-agents-aliyun, fence-agents-all, fence-agents-aws, fence-agents-azure-arm, fence-agents-compute, fence-agents-debuginfo, fence-agents-debugsource, and fence-agents-gce.

2

What kinds of PyJWT weaknesses are addressed?

The listed fixes address authentication bypasses involving empty HMAC keys and improper public-key validation, acceptance of DER public keys as HMAC secrets, JWKS redirect-based verification-key substitution, and token forgery related to Unicode byte-order mark handling.

3

Does exploitation require credentials or user interaction?

The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. It also indicates high confidentiality and integrity impact, with no availability impact.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203