Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
rocky fence-agents may let attackers control cluster nodes
published today
Summary
The fence-agents package used to manage power for cluster computers on Rocky Linux can be tricked into accepting false authentication data. This could allow an unauthorized person to restart or shut down machines in the cluster. Apply the latest security update to restore proper authentication checks.
What to do
- Update rocky fence-agents to version 0:4.10.0-110.el9_8.8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:9 | rocky | fence-agents |
< 0:4.10.0-110.el9_8.8 Fix: upgrade to 0:4.10.0-110.el9_8.8
|
Original advisory text
Critical: fence-agents security update
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
* pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
* pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)
* pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
* pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
* pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
* pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)
* pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
* pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:94500 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2542671 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2542685 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2542687 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2542690 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2542695 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:94500 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
RLSA-2026:94500 · OSV
Track software like this
Free during beta