Red Hat Product Errata RHSA-2026:25902 - Security Advisory Issued: 2026-06-15 Updated: 2026-06-15 RHSA-2026:25902 - Security Advisory Overview Updated Packages Synopsis Important: fence-agents security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for fence-agents is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2482734 - CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVEs CVE-2026-48526 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM fence-agents-4.16.0-21.el10_2.2.src.rpm SHA-256: 9f55e2bd5b14c5ecc88e2b71887eb37b8172f94dfc09ca473be698f768691351 x86_64 fence-agents-aliyun-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 893f1655318682cdded74a4c398bbe6271c35568ffda58d2a58cb24a016588ab fence-agents-all-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 22e7b35d216da69017e57a8c81fd77daaa28e1c014f682f928f03bf837343d36 fence-agents-amt-ws-4.16.0-21.el10_2.2.noarch.rpm SHA-256: fe393fec62588961251feb93228f05c10bbbef5eedb3141b5f5e2c7ccfec60ad fence-agents-apc-4.16.0-21.el10_2.2.noarch.rpm SHA-256: e642134c0cfd8ee4e0ea3681150417736710491ee1ab6d3d7d69633a942fe5f2 fence-agents-apc-snmp-4.16.0-21.el10_2.2.noarch.rpm SHA-256: c885b1dc76ad81a4d422005d25440a963c37c5c5c4e48bc92e5aa1b41d7775b0 fence-agents-aws-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: faca1c82c30632edab37b342d1b3af12c0c7f2f6a469e20a53b9bfbc85386bd3 fence-agents-azure-arm-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 8f87909e975739f325856189ad40e3d95ee9126d64b9f4351929f0fbff85464b fence-agents-bladecenter-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 2bb6246ccca1c585161c41355018adfade94ce19c627d5301f413a22e44f5ac1 fence-agents-brocade-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 74e3ff55d8249d014c40e7f8fda738c2cf1e3c96cb9f4018784aaf217cb88257 fence-agents-cisco-mds-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 206f779b2ed8f321b67fd2d3a57c8c5f4d5ea57057ac23e785f17a5c912690a6 fence-agents-cisco-ucs-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 10ca97d74f7d5eed75a0045aa82c0794b1deed8a84d2092f569835cbcba74aca fence-agents-common-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: ea613844767ac90dee179476062b72d8012da758b09f911729d6f769ba08cba1 fence-agents-common-debuginfo-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 8ed14c9cdf8ea468ef45087baeac4f8d35b9591d57d2a1911df2db6db7fb0184 fence-agents-debuginfo-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 41a575dd120da3bbc2f864cc1b3ef0e6a81b3433e5d234d3021f923297d5d854 fence-agents-debugsource-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 6b07e64146d182334a48a142a9e4a6b358a3fd22a319963cc3a1f2dd5d487766 fence-agents-drac5-4.16.0-21.el10_2.2.noarch.rpm SHA-256: cebd47fd483c039bde46c85de8c0a704dff50609911e3edffa1b06df893f886a fence-agents-eaton-snmp-4.16.0-21.el10_2.2.noarch.rpm SHA-256: a4036b77564652dcdc69c989014626ae54cd1564e85a8781d2a57f3216b963e3 fence-agents-emerson-4.16.0-21.el10_2.2.noarch.rpm SHA-256: c41132de06f1bfe113e34c739264778f2a4d92e21c5887f680393eda1cca2beb fence-agents-eps-4.16.0-21.el10_2.2.noarch.rpm SHA-256: b94c955a31b0dc5509c6490b6f7e1777e241f9c03b366ca535ab857ca273d45c fence-agents-gce-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: ece482b5ad17c3087933bb6282768566cfa9f758a0d6e535726963d2ec97002f fence-agents-heuristics-ping-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 53839b20b7b20fbf9dbb0f62b6cea8124bca1e6c85f55a0a8662d08a6973e589 fence-agents-hpblade-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 623d17ef0d7e13883e35e33186bd33f24d6a0ee137e17687f2b404b13171289a fence-agents-ibm-powervs-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 7c26cafe982bf159428dab70b51c2b5a65887e55e2675c73eb52790f509b363f fence-agents-ibm-vpc-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 1107206564dc8557c0db5393168b6f2a1f4323ac6685006b0a95dbef6380ba7a fence-agents-ibmblade-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 91ae7731bc7420637e300affacf86d07947071266c4b0835272ebb7367c87e16 fence-agents-ifmib-4.16.0-21.el10_2.2.noarch.rpm SHA-256: e6a8a0c873fefa09e5c7f320a90a8647e271cfa8345d81066955721c9203bbe9 fence-agents-ilo-moonshot-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 03f26052955364814071f59da34dfa17465a4e54ea7c6fc288ae31256b279c3a fence-agents-ilo-mp-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 6ba6652c1e4d9c64ab848a73b1a0d8c2c0e12b1303101ff49138db6b82ec763f fence-agents-ilo-ssh-4.16.0-21.el10_2.2.noarch.rpm SHA-256: f67a0a0dfbcefa1ace6c27c0ecad001844b13ebdf40886fbc1b6c251e2b40624 fence-agents-ilo2-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 4a3c04a49e3c608aef700bbd94941962545003b6487f74a345e3c68191ff505c fence-agents-intelmodular-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 04cd5c657d4ea205095df552e99be7806dd8a5a65e8178e804844c9ec5d635a1 fence-agents-ipdu-4.16.0-21.el10_2.2.noarch.rpm SHA-256: ac3e040caf8a5337dad048cd16adc0ad583a9a660a0e7947ef08880b1918b645 fence-agents-ipmilan-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 33be89a14c4d3beb0f049115e6a39478609ddfecbe20ba252c48bbcfe9d4cb01 fence-agents-kdump-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 10e4ec663bc8862bebe4bce506bf02e48e73f6f4fb55cebd622c5feed7a30d1e fence-agents-kdump-debuginfo-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 583e64081a778c8c25e517878e406d578e139423d40ed9f4ac72e4b195929072 fence-agents-kubevirt-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 6f50412d0dd0dd5379946e6c9eeebb8eab3f5ff8f234e1990b10783857bcce18 fence-agents-mpath-4.16.0-21.el10_2.2.noarch.rpm SHA-256: c0d8c6bb48619cf174e333f6cdaf51692b017e996821007785fab011c95f879b fence-agents-nutanix-ahv-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 4418689a30552a4e1ad8c04dd278597f96400a355fa723de021847c2da1f6944 fence-agents-openstack-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 9dcbf17cdd3ebb4c53df2c400cd8333a0b1a5cd1f4b7144f66a750dc3d9a63bf fence-agents-redfish-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: f89f19ecc61d8fb381e30bce5fc73325b4aaf21b70a6c4f37fa27ef20646ea90 fence-agents-rhevm-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 94baf82351cc6ee7f78c0ea8982cdffc9179805618a407978452917c8a1fd3f8 fence-agents-rsa-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 341c1460aa7319456cc71885ac64ef42a2765f6485cb168f2948e6d7de201d72 fence-agents-rsb-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 41165a9d98317e263607b388a3d3bde3e6b3c922e5a967bc97bdbd967617d1f7 fence-agents-sbd-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 0850d26db1a85900b7128ff4f90d56d72dc0f0aee05794fd28d278655d24c31c fence-agents-scsi-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 570cf5c6c01bd63022dd05dfa09060eca6e8783aad6dae9e04b9adbc3e0c286a fence-agents-virsh-4.16.0-21.el10_2.2.noarch.rpm SHA-256: 77ba4e94c653c744ec2ebdacb005156658850b400663dae597b259889c294e2e fence-agents-vmware-rest-4.16.0-21.el10_2.2.noarch.rpm SHA-256: b6d98433b047b6343de77d1bbcfae7518628916765481862ba5b372321676994 fence-agents-vmware-soap-4.16.0-21.el10_2.2.noarch.rpm SHA-256: bfe8d457a8e0e4b9c64292490cf0f6798b2495de4d617679cdb2acdce0343dac fence-agents-wti-4.16.0-21.el10_2.2.noarch.rpm SHA-256: d3d214716979c3751e2b7800f9d383dc0f9d1c31da9a8f42d321ade549086c8c fence-virt-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: dd1f8b3b422e383a1d7956929a9eadf7fe71c0d43851c03f9e241ecfda20c929 fence-virt-debuginfo-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 5bfd7fc9868a0adee2e1230292a470dfbe6e993ec8e7bf1a1cc78fd5f2573f96 fence-virtd-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: a49dc534cc88b20e906df895e8cdddd181b5f8e5e140f25a69c63a5b4da94b04 fence-virtd-cpg-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: e3675f9de301bc723c2f1bad0fdb2eb4f00ad39e7cdb537bd43ade76a68127a6 fence-virtd-cpg-debuginfo-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 70d4b720497028ec11cc595dc9f32ca28bead668967636178c2510faaf5d645d fence-virtd-debuginfo-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 8ea316d265bb30176f98a8c9745eac48b72d5a697dec6c62623622a8fb195c20 fence-virtd-libvirt-4.16.0-21.el10_2.2.x86_64.rpm SHA-256: 841d908b23739251b33b1b2dd2a066f7be9442b0dd0a615a64ea0e8757
An authentication bypass vulnerability (CVE-2026-48526, CVSS 7.4 HIGH) in the PyJWT library allows an attacker to forge JSON Web Tokens, potentially compromising systems using the `fence-agents` package for cluster power management. The vulnerability affects PyJWT versions prior to 2.13.0. The fix requires upgrading PyJWT to version 2.13.0, which is included in the provided Red Hat `fence-agents` security update for RHEL 10.