Red Hat Product Errata RHSA-2026:35835 - Security Advisory Issued: 2026-07-06 Updated: 2026-07-06 RHSA-2026:35835 - Security Advisory Overview Updated Packages Synopsis Important: fence-agents security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for fence-agents is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2482734 - CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVEs CVE-2026-48526 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM fence-agents-4.10.0-86.el9_6.18.src.rpm SHA-256: 3e07c77e6a86b4b9a84690bae9fce65f863f9f5f96ec6dc835a5b142cb9383a9 x86_64 fence-agents-aliyun-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: c2fdfa347f477f4505653a3a64e1cc53aaf2a9530e7e501ac73393676fa2fe6b fence-agents-all-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: e753980176f1fdddce1c7df2a1f2497b55fcf43225f829179e5e2d9444d6df9a fence-agents-amt-ws-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 56acea021a8fe38d0779a67a8f9824522b736db23dc3eefb84748d58f8c02112 fence-agents-apc-4.10.0-86.el9_6.18.noarch.rpm SHA-256: d718d939ae12b06edbb4232eeb2f9175f8d5d0882f58c05fd27e31ddde2b7c86 fence-agents-apc-snmp-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 100761c2812775df5b82af8613640bd98bc9be3496778e58a83341d090880503 fence-agents-aws-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: 0b8a10becca9aaaaefab013ba4d13c417f5fa20f856b34272700adc2cd6e268c fence-agents-azure-arm-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: 7baa7f93436ef90c125f95943110f09a3c42670021fd78107805e63f14958ef0 fence-agents-bladecenter-4.10.0-86.el9_6.18.noarch.rpm SHA-256: deb401507d5dc28e78b2c627ae329522faaac176d87702d8d8eb304f08848b56 fence-agents-brocade-4.10.0-86.el9_6.18.noarch.rpm SHA-256: f71588ed6333f285a806566fe9a2c0854f835dc709ba23c369e6369ece285968 fence-agents-cisco-mds-4.10.0-86.el9_6.18.noarch.rpm SHA-256: bcf98272051b0f85106723683b9aa3f2afe224bc01354f958c576d3bf8aa92d4 fence-agents-cisco-ucs-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 62002ec7d709078a0f86b107fa8074d88ea20c40e9237c810c1d4f007c8911ba fence-agents-common-4.10.0-86.el9_6.18.noarch.rpm SHA-256: a1a56884d66bca9228161d1cb34cc73e0e2b1d5e105e5d9ad9dce23832120fdd fence-agents-compute-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: 19fef6d35ca45d3633fb54537b959d136eb33a8c2c25738a498d3c1492a61c1c fence-agents-debuginfo-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: ef2784daad02832ce7ee7d9ba45809c4ad925942ee45d5cd18b363fea5c5e890 fence-agents-debugsource-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: ea1b1f89213a992bc88ecec3d163c6bd2f0ddd95cc970b462fda4bfb64198973 fence-agents-drac5-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 7a95a5f4ffc45099a16c4759a56e494ec2abfbd3bec65aba73dc6e2c2e16aa4b fence-agents-eaton-snmp-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 5a2152bba8a2df0f88e3f8e3671ebb1c552370afdfdaf0de65c9342de20123f4 fence-agents-emerson-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 640feb933e13f4aedb3e853e5cf793e4df46c59d0d27bde80cee4ed9c4cc76a8 fence-agents-eps-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 9fd6680944793e8cad2398864c4e863800280a52cbedf9a48372431f2554e58c fence-agents-gce-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: c1c5719811476b9439ce599b63e606d6840fddb4751c4cac18cb34078afbf3aa fence-agents-heuristics-ping-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 9a9db5176bd1cdba0361c0e7beaa37fe4f0f890fac5aff6df5f38681cb932c1e fence-agents-hpblade-4.10.0-86.el9_6.18.noarch.rpm SHA-256: adae8f05a9732d32cd9d348c7584be92da2a7b4eda3f947f90c58842ae5869cb fence-agents-ibm-powervs-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 11f5b09ab87fb03be9310b499087e1ce88832f26307da23770a5ee15acf3edee fence-agents-ibm-vpc-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 7b61d9a74b820e5b458057c0d5d3f89d25f48b953702db15440ddf15d729dc0a fence-agents-ibmblade-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 5e202eb3d9383dcd293529825456d33ee57a51ef00ca0562bef2070c9fe643bf fence-agents-ifmib-4.10.0-86.el9_6.18.noarch.rpm SHA-256: a514ceb9c227b77324a4f02116ebf4da86791d2c3cbaaebe12c472dc87a52f27 fence-agents-ilo-moonshot-4.10.0-86.el9_6.18.noarch.rpm SHA-256: a10f15f2e3613fe0adf98da862b61644560895968afb717574c491dd085b71f9 fence-agents-ilo-mp-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 0f9537a919e4d4beb74b0e59ad18d23d0af4f5de2e6c646cf87419e10939c6e3 fence-agents-ilo-ssh-4.10.0-86.el9_6.18.noarch.rpm SHA-256: a6b943d2c92696cd464f24db8b78f1cae175deccb1598f1fb1ca89a82e23fe86 fence-agents-ilo2-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 08c8b460e39ed86a04f4284bcc619b72211c96acf291d809a6fe93441999bab4 fence-agents-intelmodular-4.10.0-86.el9_6.18.noarch.rpm SHA-256: f1ba1f3461751a5112ab4ae474e4beb4b74699a21baf95d8428cfe633a9b50ed fence-agents-ipdu-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 0cf3d5a7c5b5171014f42afa2f0b67c599959ee2f64cc45b9651a7c2d99bee98 fence-agents-ipmilan-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 5aff163c309da40f18f5de39937a83b8c8dc8f5008d03f4911d7a65efbf9fdba fence-agents-kdump-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: 1b573ea800b095d9b426cf000fc0b583d97ee59d1fd3ecf684b91aea2abb4007 fence-agents-kdump-debuginfo-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: f4102cf7fdda2b030004a0927423589964cc5f8e6e8e6469e8d4f662d03ca85d fence-agents-kubevirt-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: 6659fec67979c6041a5604566543b42bbdd4da15da67dc58954e252edf1bf671 fence-agents-kubevirt-debuginfo-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: de7706bbd9f2ae207b6e583de4c708785a1188651d4bd4bd0ade327e11cfec7e fence-agents-lpar-4.10.0-86.el9_6.18.noarch.rpm SHA-256: a176b2b56ada38a50eaa6f97d6174705812b29d94fde30e7477385475db42579 fence-agents-mpath-4.10.0-86.el9_6.18.noarch.rpm SHA-256: b8b51e2743d4402dfc30848eb57f2678928e5deee8712249570b81297f4572ff fence-agents-nutanix-ahv-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 746a95eb7b8ea0cb463d457a65d51d1e9fb17766bbf43df4d44a0df7675c6c7c fence-agents-openstack-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: 966f670c2910847c7d82bd481eaea81abeec3bea6fb26b479ea31cb2539c8f6f fence-agents-redfish-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: fc91ef369c417c80ffc3cf0847b0086848fbc8c8618304b4823b936619c5674a fence-agents-rhevm-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 218ab41f9e0fb9e71f7bcf8de5a8a1d0d4fc3ce87f64273d2272d4df1dedc79d fence-agents-rsa-4.10.0-86.el9_6.18.noarch.rpm SHA-256: e4a7ad06712653db58ff988aa94a94b41ccab24d28445bf9ff6b77111f1c9c95 fence-agents-rsb-4.10.0-86.el9_6.18.noarch.rpm SHA-256: e9e3052a7bba895629bc3c6125baf26e1ee0f8e60f7e2c4da513249e8880ad01 fence-agents-sbd-4.10.0-86.el9_6.18.noarch.rpm SHA-256: cb2741d314ba77f8aca6b9942eda9a09214fe6a848356d175f02751993318ed4 fence-agents-scsi-4.10.0-86.el9_6.18.noarch.rpm SHA-256: cc945320afea5a03ac313f492ee928e0c49bf9c87dc2bf9caa0a51fb27ded391 fence-agents-virsh-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 6b283e252e939c7b071c4e9c3811503c57c2de85cc243574c467165900b7678c fence-agents-vmware-rest-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 11ec1aeeb53ccf242b6c7df0ac80881061efc1adb620970108f6b08a517befdc fence-agents-vmware-soap-4.10.0-86.el9_6.18.noarch.rpm SHA-256: be1cb85dba1c5702ea3352464a1dbd1900c26c50e09041df588a82b9a328bb28 fence-agents-wti-4.10.0-86.el9_6.18.noarch.rpm SHA-256: 0033aa79fdb6da51984c018d61882a4180c47ca4d018103a8ef7359da5297491 fence-virt-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: 3cbffd6ba86750ca6e47eedb7209602f0334ae82390d4bb2d60099637dc6fbe4 fence-virt-debuginfo-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: e15cb2c13879e69c736c9d930b8f9545b9659d0d625e01ab7b3eafcceff2ceb5 fence-virtd-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: 5aad65643114b16eb1115b8d3fe1e53d009f946ab309dc13b69144202c3bba43 fence-virtd-cpg-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: b6dbdb84b17594c3f56e5eba5454dedfb6fbbc44ac44574a1981117f33b100e4 fence-virtd-cpg-debuginfo-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: a1fe8c040935f91c233c8104e52ddc85e4a00e41a0f9ca282e75c5510b6457d0 fence-virtd-debuginfo-4.10.0-86.el9_6.18.x86_64.rpm SHA-256: cbc47ff1f9289b81829c8b0b6
An authentication bypass vulnerability (CVE-2026-48526, CVSS 7.4 HIGH) in the PyJWT library allows attackers to forge valid JSON Web Tokens. The flaw affects the fence-agents package in RHEL 9.6 EUS due to its dependency on PyJWT versions prior to 2.13.0. The fix requires updating the underlying PyJWT library to version 2.13.0, which is included in the provided fence-agents security update.