Read the docs
TI-2026-35886 Aliases CVE-2026-48526GHSA-xgmm-8j9v-c9wx

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Priority HIGH 68CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 39 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00427 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pyjwt (jpadilla): 2.13.0pyjwt (PyPI): 2.13.0Red Hat: 49 advisoriesRed Hat: 39 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jpadillapyjwtbefore 2.13.02.13.0Patch availableCNA
—pyjwt (PyPI)before 2.13.02.13.0Patch availableGHSA-xgmm-8j9v-c9wx
  • pyjwt Vendorjpadilla Affected before 2.13.0 Fixed in 2.13.0 Patch available CNA
  • pyjwt (PyPI) Vendor— Affected before 2.13.0 Fixed in 2.13.0 Patch available GHSA-xgmm-8j9v-c9wx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*before 2.13.0Vulnerablejpadilla
  • cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:* Versions before 2.13.0 Vulnerable ·jpadilla

Remediation

  • Fix · CNA pyjwt (jpadilla) Fixed in 2.13.0
  • Fix · GHSA-xgmm-8j9v-c9wx pyjwt (PyPI) Fixed in 2.13.0 Advisory →

Red Hat 49 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:76150 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
Show 46 more Red Hat advisories
  • RHSA-2026:76149 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:70995 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:70979 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:70969 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:70965 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:69469 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:69467 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:69466 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:69464 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:60367 Released 2026-08-26 · Red Hat rating Critical
    RHOAI 3.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9, registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9
  • RHSA-2026:50904 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4 - GA Release of Model Transparency 1.0.3
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:50336 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.7-1.el10ap, receptorctl-1.6.7-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.15-2.el9ap, automation-controller-cli-4.7.15-2.el9ap, automation-controller-server-4.7.15-2.el9ap +15
  • RHSA-2026:50340 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9 +7
  • RHSA-2026:50319 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.31-1.el8ap, automation-eda-controller-1.1.21-1.el8ap, automation-eda-controller-base-1.1.21-1.el8ap +11
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.31-1.el9ap, automation-eda-controller-1.1.21-1.el9ap, automation-eda-controller-base-1.1.21-1.el9ap +11
  • RHSA-2026:50263 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.18.8 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python3.12-pillow-12.3.0-1.el9pc +5
  • RHSA-2026:50223 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.16.12 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 libsolv-1:0.7.20-7.el8sat, openvox-agent-8.24.1-3.el8sat, openvox-server-8.14.1-1.el8sat +9
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python-pillow-12.3.0-1.el9pc +7
  • RHSA-2026:50222 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.17.10 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python-pillow-12.3.0-1.el9pc +7
  • RHSA-2026:48085 Released 2026-07-29 · Red Hat rating Important
    Red Hat Quay 3.18.0
    • Red Hat Quay 3.18 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:43038 Released 2026-07-21 · Red Hat rating Critical
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9
  • RHSA-2026:42796 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.15.6
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42644 Released 2026-07-21 · Red Hat rating Important
    RHOAI 2.25.9 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
  • RHSA-2026:42144 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +1
  • RHSA-2026:42142 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/gateway-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9, registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9 +3
  • RHSA-2026:42132 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:41066 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.16.5
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:40967 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/segment-reporting-rhel9
  • RHSA-2026:37275 Released 2026-07-09 · Red Hat rating Critical
    RHOAI 3.3.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9, registry.redhat.io/rhoai/odh-feast-operator-rhel9 +45
  • RHSA-2026:36350 Released 2026-07-07 · Red Hat rating Important
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:35837 Released 2026-07-06 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.23, fence-agents-common-4.10.0-43.el9_2.23, fence-agents-compute-4.10.0-43.el9_2.23 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.23, fence-agents-all-4.10.0-43.el9_2.23, fence-agents-amt-ws-4.10.0-43.el9_2.23 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.23, fence-agents-all-4.10.0-43.el9_2.23, fence-agents-amt-ws-4.10.0-43.el9_2.23 +39
  • RHSA-2026:35835 Released 2026-07-06 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-agents-4.10.0-86.el9_6.18, fence-agents-aliyun-4.10.0-86.el9_6.18, fence-agents-all-4.10.0-86.el9_6.18 +47
  • RHSA-2026:35836 Released 2026-07-06 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) fence-agents-4.10.0-62.el9_4.26, fence-agents-common-4.10.0-62.el9_4.26, fence-agents-compute-4.10.0-62.el9_4.26 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.26, fence-agents-all-4.10.0-62.el9_4.26, fence-agents-amt-ws-4.10.0-62.el9_4.26 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.26, fence-agents-all-4.10.0-62.el9_4.26, fence-agents-amt-ws-4.10.0-62.el9_4.26 +39
  • RHSA-2026:35845 Released 2026-07-06 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) fence-agents-4.16.0-5.el10_0.11, fence-agents-aliyun-4.16.0-5.el10_0.11, fence-agents-all-4.16.0-5.el10_0.11 +47
  • RHSA-2026:34365 Released 2026-07-01 · Red Hat rating Important
    Satellite 6.19.2 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 candlepin-4.7.5-1.el9sat, candlepin-selinux-4.7.5-1.el9sat, foreman-3.18.0.7-1.el9sat +17
  • RHSA-2026:34374 Released 2026-07-01 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +5
  • RHSA-2026:34160 Released 2026-07-01 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.13-2.el9ap, automation-controller-cli-4.7.13-2.el9ap, automation-controller-server-4.7.13-2.el9ap +7
  • RHSA-2026:33683 Released 2026-06-30 · Red Hat rating Important
    Red Hat Quay 3.10.23
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:30089 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:30088 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:30076 Released 2026-06-25 · Red Hat rating Important
    Red Hat Quay 3.12.19
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:28571 Released 2026-06-23 · Red Hat rating Important
    Red Hat Quay 3.9.23
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:26206 Released 2026-06-16 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-110.el9_8.3, fence-agents-aliyun-4.10.0-110.el9_8.3, fence-agents-all-4.10.0-110.el9_8.3 +47
  • RHSA-2026:25928 Released 2026-06-15 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9 +3
  • RHSA-2026:25902 Released 2026-06-15 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 10) fence-agents-4.16.0-21.el10_2.2, fence-agents-aliyun-4.16.0-21.el10_2.2, fence-agents-all-4.16.0-21.el10_2.2 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat AI Inference Server 3.3Fixed RHSA-2026:30088, RHSA-2026:30089
Red Hat AI Inference Server 3.4Fixed RHSA-2026:69464, RHSA-2026:69466, RHSA-2026:69467, RHSA-2026:69469, RHSA-2026:70965, RHSA-2026:70969, RHSA-2026:70979, RHSA-2026:70995
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:42144
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:50319
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:50319
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:34374, RHSA-2026:42132
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:34160, RHSA-2026:50336
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:25928, RHSA-2026:42142, RHSA-2026:50340
Red Hat Enterprise Linux AI 3.4Fixed RHSA-2026:76149, RHSA-2026:76150
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:25902
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:26206
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:35837
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:35836
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:35845
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:35835
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:35837
Red Hat Enterprise Linux High Availability E4S (v.9.4)Fixed RHSA-2026:35836
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:35837
Red Hat Enterprise Linux Resilient Storage E4S (v.9.4)Fixed RHSA-2026:35836
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:43038
Red Hat OpenShift AI 2.25Fixed RHSA-2026:42644, RHSA-2026:87410
Red Hat OpenShift AI 3.3Fixed RHSA-2026:37275, RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:60367
Red Hat Quay 3.10Fixed RHSA-2026:33683
Red Hat Quay 3.12Fixed RHSA-2026:30076
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:42796
Red Hat Quay 3.16Fixed RHSA-2026:41066
Red Hat Quay 3.18Fixed RHSA-2026:48085
Red Hat Quay 3.9Fixed RHSA-2026:28571
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:50223
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:50223
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:50222
Red Hat Satellite 6.18Fixed RHSA-2026:36350
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:50263
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:34365
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:40967
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:50904
Not affected: 29 products
  • OpenShift Lightspeed
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.18
  • Red Hat Quay 3.9
  • Red Hat Satellite 6
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9
  • Red Hat Update Infrastructure 4 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48526
  2. 2026-10-03 Alias added: GHSA-xgmm-8j9v-c9wx
  3. 2026-10-06 Fix available: RHSA-2026:76149 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76150 · Red Hat
  5. 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.4 · Red Hat
  6. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  7. 2026-10-07 Affected versions changed · Red Hat
  8. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  9. 2026-10-20 Affected versions changed · Red Hat
  10. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  11. 2026-10-23 Affected versions changed · Red Hat
  12. 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-65303 Improper signature verification in jpadilla pyjwt CVSS 3.1CRITICAL 9.1
  • TI-2026-65301 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation CVSS 3.1CRITICAL 9.1
  • TI-2026-65219 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse… CVSS 3.1HIGH 7.5
  • TI-2026-65218 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) CVSS 3.1HIGH 7.5
  • TI-2026-25107 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) CVSS 3.1HIGH 7.5
  • TI-2026-65310 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion CVSS 3.1HIGH 8.2
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences