Red Hat warns about a flaw in Red Hat candlepin
KROMSE explanation
Red Hat candlepin has a critical security flaw (CVE-2026-102267, CVSS 7.4). The official record says: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect.
No confirmed attacks and no public attack code yet.
Anyone running Red Hat candlepin.
- Install the maker's update for Red Hat candlepin as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
