Red Hat Product Errata RHSA-2026:35845 - Security Advisory Issued: 2026-07-06 Updated: 2026-07-06 RHSA-2026:35845 - Security Advisory Overview Updated Packages Synopsis Important: fence-agents security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for fence-agents is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2482734 - CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVEs CVE-2026-48526 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM fence-agents-4.16.0-5.el10_0.11.src.rpm SHA-256: f7d6a753fbcacfde7bad6647ce9491893ca57224088e16eff042e30d5af049e9 x86_64 fence-agents-aliyun-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: db4d83c3ec624cf3510977a8c58ec3c7cbfb93148c759ad9e25f34b4a5db41d1 fence-agents-all-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 38358b47e70663f1dac94593e1dbecb325fe496cc4fd19b3152aecc3fb2a8041 fence-agents-amt-ws-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 7cc0295e069ef70bdf8ff1b5e3e6ec987c1c534a8ba8793357cd81ad47da34b1 fence-agents-apc-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 608c2f35cb5d9ce74a65a3fe3cae53fad93cb72193b5fb75cdbe87dbb3a9765f fence-agents-apc-snmp-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 49b3d4ea16d5277fb8522516b600a84b77460b47ba22f44feae107198e8dd7a3 fence-agents-aws-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: dac1596aa8537ec0c3ccd41841c869f333d745a1660e222e1a934e70d9c1b96c fence-agents-azure-arm-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 482bf57aa6e8efb1587735965a6edcf530e6dd5126339a8209381e500a2b00be fence-agents-bladecenter-4.16.0-5.el10_0.11.noarch.rpm SHA-256: eb515ebb30292413454cdde2d90a421363c6873ddf747a7956dd681b43fa1f61 fence-agents-brocade-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 0d38f5045c9ab0b8edec08a1fa13178bada7d6ba03765809fca247a42c98b685 fence-agents-cisco-mds-4.16.0-5.el10_0.11.noarch.rpm SHA-256: e9e4e0d11b924f1c84128a62da04e88d2fc8c1c974f945549b8e5cf2cab9f5d5 fence-agents-cisco-ucs-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 290ee8a12ad2ad1478093f59e546fc347ca7197dbfbc47a7b0a353f7af599354 fence-agents-common-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 1aa69a4ea8096f021200170e50fd36bd3abc41f34c42ac1183597988b35ca301 fence-agents-common-debuginfo-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 633fe4e50d3ea2b0d006864f9d694c8f10af513f5da1e3f7392a519996190a3c fence-agents-debuginfo-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: bff847ce1e8ba8336b729fdf10553fd1c2cc08b73fedd0aefcf3049e33460a71 fence-agents-debugsource-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 7306cc599178c360e7897db0cc44b18db014742d378cef881e1df1f54cef0658 fence-agents-drac5-4.16.0-5.el10_0.11.noarch.rpm SHA-256: ff196201eedb7de514531f7163b8c0d26a4dc08d8af4d1b74c5d2b0cd7009120 fence-agents-eaton-snmp-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 70c4cb6d29f635c121921edef248d25239de8d49687d51825e5d6704861a5883 fence-agents-emerson-4.16.0-5.el10_0.11.noarch.rpm SHA-256: b7677319c0f3ba3ab5654a3631f1b2693dc77c79933601df1d3f2984d54a8c37 fence-agents-eps-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 27c500b0478b7e330b45faf5ca0d43b5c79b82d4ab4544233e17e1dea7b6e01e fence-agents-gce-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 96337e3d56279ea4ff52fd50cce59e4d93505db2f4b8deac398c6bfc7004be45 fence-agents-heuristics-ping-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 2a4961c7107a33d668507550134b144203572cae04acbbd24ec4a61f53390d6b fence-agents-hpblade-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 835f7207405066ed67e5de9824a041359f83e23bd5be3e3293cc7de8cfb424a2 fence-agents-ibm-powervs-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 7b8267b36637c0acac87f7674d85be6de81a316c5b6439f3a0fed4eb9224fc5f fence-agents-ibm-vpc-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 0a179a707e3a23f5068aa5d0f3ae4f3ff6362cfa9551083b53ce48751fb91f59 fence-agents-ibmblade-4.16.0-5.el10_0.11.noarch.rpm SHA-256: bbef4420f0519be5258628961d4107ae186a8e39e693cfde884053967f795620 fence-agents-ifmib-4.16.0-5.el10_0.11.noarch.rpm SHA-256: a2b6e3752143d716ed1d69530f33bd5393510d512a8534497099e7ef94a41b98 fence-agents-ilo-moonshot-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 07696e5b367a399c4626f6b4b15f080b6337e223b2a4ff78160a6a39fc5d32ab fence-agents-ilo-mp-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 73870fdb757f8a8d32e68443050904ebc3eb0314242ed913211fdd06a732c0be fence-agents-ilo-ssh-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 460284f3eb639505f0db7fbd74e493e4223fb009148bab523b9e7f7e471c66f2 fence-agents-ilo2-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 786caaf7eedfb878a0c9cca24574d6c1aa0b19d82d571cef02dc52eb52278b36 fence-agents-intelmodular-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 457fde24eeb8a570d0707144a4d06c590358264722374c94bb23dc73e70e9ca0 fence-agents-ipdu-4.16.0-5.el10_0.11.noarch.rpm SHA-256: d00a3ad5d56f2819aea6bf6fff955b7165db8a5b4d432e04006127efc316f46f fence-agents-ipmilan-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 773d4df8e57d99bd67e02b76856c874fce66f399833c1e9bf33e15377c08f8dc fence-agents-kdump-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 291b16e43054dacc1e9c3478a9c105eca3e796832deb80c9d75aecb032377142 fence-agents-kdump-debuginfo-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 01b54268a7c7f15e77d8f2aece75d7d21e57f7009d2136680d11e4687f704066 fence-agents-kubevirt-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 19c5fd8aa5a355e729f44db912017c3af636b48cbe7c2f10a2fdce7071590e67 fence-agents-mpath-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 6805861831bd0c7f8b60cbfcce4059fef5e9e601875907f46724259ff363045f fence-agents-nutanix-ahv-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 299e654fd44546340348a4464a96fc850dc1ff4921dd408885cf45cb0e5de8dc fence-agents-openstack-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: b8e769aee90b610012355e597e20caf0a8bd6c8079c23af98f87b7b35b467f5e fence-agents-redfish-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: f5e495900e43bafa7a92323427a482eebd435801fff627636c4bea2d40b957fe fence-agents-rhevm-4.16.0-5.el10_0.11.noarch.rpm SHA-256: dec2a61dbcc1edbdabda1b0d560476dc3ca2130a7842d38cb00c114400e7efb7 fence-agents-rsa-4.16.0-5.el10_0.11.noarch.rpm SHA-256: f5cec00516df63936d09996f7e7578e25048160cbc7af4c8ec0a0b35c68f7b56 fence-agents-rsb-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 2f07864079cb7402bf9f4c1b190c18170bad7a759365aa5923d3593e1914b154 fence-agents-sbd-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 5b7c5bbf2e090d96da1b5b20d606e86146ab40ee16a4b164ab6436c4e0100ec3 fence-agents-scsi-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 1a4d5176dc412fe0ed466c3472e40c8de72a41f27b492cd64d497149d20723d0 fence-agents-virsh-4.16.0-5.el10_0.11.noarch.rpm SHA-256: a772b8ba14b43ba6ec6091bcdc27d24740104a0ff3df6efa4942a3e367cab06f fence-agents-vmware-rest-4.16.0-5.el10_0.11.noarch.rpm SHA-256: cd9d0cafdf600e2200f3888d6e3f0ddc54951f67ceb36a6b7d4aa154f5ad9ab1 fence-agents-vmware-soap-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 3c1bccc66b1bea4e1b6d211e4e9af0a5adbf9be18a153865cb9d64017db10509 fence-agents-wti-4.16.0-5.el10_0.11.noarch.rpm SHA-256: 705e8574a98c0f3c981589070abd0762ea8ddf5704248e65a65ec19993765b85 fence-virt-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 87e7d4584f7e547a2a14852c0525c6f7da290313f045b95dc5ce0d4cb44a341e fence-virt-debuginfo-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 1249ffad9a521f83e8bffbe1572042a8a0c78242a2b505767925f26541291a73 fence-virtd-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: e1e95ee8699eb0266a9c0e1cb78ccb7e46ec916c367bb5c4d4834af76c6be07a fence-virtd-cpg-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 671eab1f85927268dffba923152956318d9d7c4ffd42b35ce5ed1640402a05f0 fence-virtd-cpg-debuginfo-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 4abd1e990d8fcefa0f90f43d12a376aaaf15a014be3c684f50c91e1fb94a79f6 fence-virtd-debuginfo-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 6efba357ec2a9f07eafc21c44c61922ef32be7d2adfcc1b25e17cc21b683d318 fence-virtd-libvirt-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: d4d01dcb44b61d6f281be4bae233ba22a7b358cfce82678d5a3fd19e98a335f8 fence-virtd-libvirt-debuginfo-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 8241c90df53562705f1ab0adf7eaf45c27555ef1d4173c12aa226c19c7a499b4 fence-virtd-multicast-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: 30a9610ca61f24cd01f50335eb031a53a19962d91130394ef5b1f21848b84a61 fence-virtd-multicast-debuginfo-4.16.0-5.el10_0.11.x86_64.rpm SHA-256: c83bc741b21fab1384024da87d4f90233472af046f47a1434f0a8c9e13e6481c fence-virtd-serial-4.16.0-5.el10_0.11.x86_64.rpm SH
An authentication bypass vulnerability (CVE-2026-48526, CVSS 7.4 HIGH) in the PyJWT library allows attackers to forge JSON Web Tokens, potentially compromising systems using the fence-agents package for cluster power management. The vulnerability affects pyjwt versions prior to 2.13.0. The fix requires upgrading the underlying PyJWT library to version 2.13.0.