{"id":"ALSA-2026:94500","summary":"Critical: fence-agents security update","details":"The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   \n\nSecurity Fix(es):  \n\n  * pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)\n  * pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)\n  * pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)\n  * pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)\n  * pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","modified":"2026-11-04T16:45:02.633802593Z","published":"2026-11-03T00:00:00Z","related":["CVE-2026-102266","CVE-2026-102267","CVE-2026-102268","CVE-2026-102271","CVE-2026-102272"],"upstream":["CVE-2026-102266","CVE-2026-102267","CVE-2026-102268","CVE-2026-102271","CVE-2026-102272"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:94500"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102266"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102267"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102268"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102271"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102272"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2542671"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2542685"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2542687"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2542690"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2542695"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-94500.html"}],"affected":[{"package":{"name":"fence-agents-aliyun","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-aliyun"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-all","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-all"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-amt-ws","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-amt-ws"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-apc","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-apc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-apc-snmp","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-apc-snmp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-aws","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-aws"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-azure-arm","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-azure-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-bladecenter","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-bladecenter"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-cisco-ucs","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-cisco-ucs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-common","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-compute","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-compute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-drac5","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-drac5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-gce","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-gce"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-hpblade","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-hpblade"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-ibm-powervs","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-ibm-powervs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-ibm-vpc","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-ibm-vpc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-ibmblade","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-ibmblade"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-ifmib","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-ifmib"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-ilo-moonshot","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-ilo-moonshot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-ilo-mp","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-ilo-mp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-kdump","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-kdump"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-kubevirt","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-kubevirt"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-lpar","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-lpar"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-mpath","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-mpath"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-nutanix-ahv","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-nutanix-ahv"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-openstack","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-openstack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-redfish","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-redfish"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-rhevm","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-rhevm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-rsa","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-rsa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-scsi","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-scsi"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-virsh","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-virsh"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-agents-vmware-rest","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-agents-vmware-rest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-virt","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-virt"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-virtd-libvirt","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-virtd-libvirt"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-virtd-multicast","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-virtd-multicast"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"fence-virtd-serial","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/fence-virtd-serial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}},{"package":{"name":"ha-cloud-support","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/ha-cloud-support"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94500.json"}}],"schema_version":"1.9.2"}