Red Hat Product Errata RHSA-2026:35836 - Security Advisory Issued: 2026-07-06 Updated: 2026-07-06 RHSA-2026:35836 - Security Advisory Overview Updated Packages Synopsis Important: fence-agents security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for fence-agents is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux High Availability for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux High Availability for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux High Availability for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux Resilient Storage for x86_64 - 4 years of updates 9.4 x86_64 Red Hat Enterprise Linux Resilient Storage for Power, little endian - 4 years of updates 9.4 ppc64le Red Hat Enterprise Linux Resilient Storage for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Red Hat Enterprise Linux High Availability for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux High Availability for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux High Availability for IBM z Systems - Extended Life Cycle 9.4 s390x Red Hat Enterprise Linux High Availability for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux Resilient Storage for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux Resilient Storage for IBM z Systems - Extended Life Cycle 9.4 s390x Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Life Cycle 9.4 x86_64 Fixes BZ - 2482734 - CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVEs CVE-2026-48526 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM fence-agents-4.10.0-62.el9_4.26.src.rpm SHA-256: 16873cd164d9b35345e675461405298ecbc69cdd9814b61f458422f370fcce67 x86_64 fence-agents-common-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 26778d39d0d6a445a9a8e77d926b15677e98f26cc7b8e1d006a8805becac4701 fence-agents-compute-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 1370f72b898e1e58ebebfc3665126e04bc59ea82ad4ebda42476624be6dbabd6 fence-agents-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 3a601654d11602fe8a860ec6e7879a9195be71061bbbcb491d5638ef11a1f47e fence-agents-debugsource-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 81d4b068c68a214846f28bd342fd4ac5a051fff26468ae645d9832a1cb446fef fence-agents-ibm-powervs-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 4846575e9f065774a7fdca51d123281e792780c0b5f6e0b32a3acba3e519151f fence-agents-ibm-vpc-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 9dd00477e8094a3bfe4ac4c27a9a3696ad73007eae1b2f8185be213ff2bab9db fence-agents-kdump-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: b5f023e9b4ad5cada89afb51f99265a108f5f0212c48725e944479fccfc44d8b fence-agents-kubevirt-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 71d9125eabe174f8348b689a07b922ecdcd48e0f7dae523fa03493d30644c1fa fence-agents-kubevirt-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: d2c1c783406d955d473250d3e62ade6f95e9d0d5231c67a3a4ba52f24ab530a4 fence-agents-virsh-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 8d43eb145ff591b1b21456ee37935e4cba1747fe83ff96f951ffea97129752a8 fence-virt-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 61a1a9d27fe7301ba9ddc12056c33a66e0a9ec33739be1f5d7ca7d2af6dbd071 fence-virt-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 7a58f97e6f00f246f6a8f2962339eb813e6cc62040d5d644a8236a27c539d769 fence-virtd-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: ceac2e42cb8ad67a36b1901b5aa5b6a72429e69fda6fb31be13afd65acb3545c fence-virtd-cpg-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 7332f4864b6a26ea4bc05bbe7735b4a3f01d6e1235985626166db49bdeb9e583 fence-virtd-cpg-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: acf4ed592307a5a72d452e378047e14c0e77f54402a61187729ab5746072535f fence-virtd-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 97fc2ed0e1f4cf5dff2ff6fc0e8ac37285f2934d0dcbb1d322242927a7d98c3d fence-virtd-libvirt-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 391f500d0c36ffd99b32d00fe0761e86901c92805407cd3ac0d97439c0d5da82 fence-virtd-libvirt-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: db977f689b9ede705259bd0fe87d594b943f689ac7d5219e91872d14e2a92f04 fence-virtd-multicast-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 7a85ddf4db477fac8508a2fdf65d2b8d7db44b889b8e327fa9e7381aba90c3cc fence-virtd-multicast-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: cbd26b3f216d1bd62e14f0e984a7f570399a0adcfc0c84011def7e9515c8d6e2 fence-virtd-serial-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 9222121990c4c3bc10a778f4c9d599d49d5594ce9373fc31712b41ddc0d1999a fence-virtd-serial-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 923a1fc6ff657fb7551a484b073f3410be6e42d72140046443b24ea33336d6b9 fence-virtd-tcp-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 0f8d61da9a3e2bc4b58358244786a48ea38faa3a24758c49a6a0bd5f426ccd07 fence-virtd-tcp-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: c94e9de94dd84fd360210608e54763aed8e5aacad6387e51fa0317e3291981e6 ha-cloud-support-debuginfo-4.10.0-62.el9_4.26.x86_64.rpm SHA-256: 7326513072f74c49d190e5fcf65f76a30156b6fc04a2e0e3dd0eee6dcb82a4bc Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 SRPM fence-agents-4.10.0-62.el9_4.26.src.rpm SHA-256: 16873cd164d9b35345e675461405298ecbc69cdd9814b61f458422f370fcce67 ppc64le fence-agents-common-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 26778d39d0d6a445a9a8e77d926b15677e98f26cc7b8e1d006a8805becac4701 fence-agents-compute-4.10.0-62.el9_4.26.ppc64le.rpm SHA-256: 9cc94ca6d578cf2529a9619e0b8ae8359271d9c1a7b143c6f5d03e7d538613ab fence-agents-debuginfo-4.10.0-62.el9_4.26.ppc64le.rpm SHA-256: 3ea1286c2379a5f98d2d3020eb96f1762a7bdd92142d852aae07234cf56432d5 fence-agents-debugsource-4.10.0-62.el9_4.26.ppc64le.rpm SHA-256: 352bd0dadc8661d5a34e527276b2c8a07d810d55e1884ecefee6a86861eb9b73 fence-agents-ibm-powervs-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 4846575e9f065774a7fdca51d123281e792780c0b5f6e0b32a3acba3e519151f fence-agents-ibm-vpc-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 9dd00477e8094a3bfe4ac4c27a9a3696ad73007eae1b2f8185be213ff2bab9db fence-agents-kdump-debuginfo-4.10.0-62.el9_4.26.ppc64le.rpm SHA-256: 213ca385c49d7ce5a633af6c781293f06aad1801d5dfe7e1060fd64c9cb1fcc9 fence-agents-kubevirt-4.10.0-62.el9_4.26.ppc64le.rpm SHA-256: d7548172a35859b27694f71b9b993e9a5c9703a262f4ac77456c1d0e56b3afd2 fence-agents-kubevirt-debuginfo-4.10.0-62.el9_4.26.ppc64le.rpm SHA-256: 68c28d449f86be2a3838ac67755c25e73630936f28b1f29b836708d852695d35 fence-agents-virsh-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 8d43eb145ff591b1b21456ee37935e4cba1747fe83ff96f951ffea97129752a8 Red Hat Enterprise Linux High Availability for Power LE - Update Services for SAP Solutions 9.4 SRPM ppc64le fence-agents-all-4.10.0-62.el9_4.26.ppc64le.rpm SHA-256: b083da625155f9a0706a29e26b5d457fbd6747f14ffff9ff383889be5a2df399 fence-agents-amt-ws-4.10.0-62.el9_4.26.noarch.rpm SHA-256: f44f0db7f6ab7a8fb88ab588fb8e1bcdf6d4e5f3c1cace7839e3109a0eed4b37 fence-agents-apc-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 727baba5d9a447b03ec1a9be895645e6997c65b3fce3e2b80ae4cd6fd799a9bd fence-agents-apc-snmp-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 7805aea46f013c82bdde8d518ffe1f7110a36418623003373c04edd4d15c6e45 fence-agents-bladecenter-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 6ecef7aecd635ee1190723a1faeeff21561349abe5ee51eee507435064ae2172 fence-agents-brocade-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 6a6656d2979b7346c9a524b2c8138a3d0f9810ee4712a3f8f66b255c23cfa355 fence-agents-cisco-mds-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 93b210081653a7d9a1e5770adc98930549bfaa15cfdd3a3811e999a12c7d2b84 fence-agents-cisco-ucs-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 4d3ac5657bce9e1f24f0ac8307f999cb5ad1f85e7d9d99469817e6318f728952 fence-agents-debuginfo-4.10.0-62.el9_4.26.ppc64le.rpm SHA-256: 3ea1286c2379a5f98d2d3020eb96f1762a7bdd92142d852aae07234cf56432d5 fence-agents-debugsource-4.10.0-62.el9_4.26.ppc64le.rpm SHA-256: 352bd0dadc8661d5a34e527276b2c8a07d810d55e1884ecefee6a86861eb9b73 fence-agents-drac5-4.10.0-62.el9_4.26.noarch.rpm SHA-256: 3585de
An authentication bypass vulnerability (CVE-2026-48526, CVSS 7.4 High) in the PyJWT library allows attackers to forge JSON Web Tokens. The vulnerability affects pyjwt versions prior to 2.13.0 and is addressed by upgrading to pyjwt version 2.13.0. This flaw impacts the fence-agents package in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, which relies on the vulnerable library for cluster power management.