Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Important: fence-agents Security Update Needed for Power Management

published 4 months ago

Summary

The fence-agents software, used for remotely managing power on cluster devices, contains a security issue that could allow unauthorized access to the system. This could lead to a node being restarted or removed from the cluster without proper authorization. Update the software to fix this issue.

What to do

Update rocky fence-agents to version 0:4.16.0-21.el10_2.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:10	rocky	fence-agents	< 0:4.16.0-21.el10_2.2 Fix: upgrade to 0:4.16.0-21.el10_2.2

Original advisory text

Important: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es):

* python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:25902 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2482734 Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

7.4 High

Timeline

Published16 Jun 2026

Updated16 Jun 2026

First seen16 Jun 2026

Sources

RLSA-2026:25902 · OSV

Track software like this

Free during beta