There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0,
    HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying
    prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As
    a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently,
    forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.
    (CVE-2026-102266)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - PyJWT 是 JSON Web 令牌標準的 Python 實作。從 2.13.0 直到 2.14.0，HMACAlgorithm.from_jwk會受到影響，因為 PyJWK 驗證路徑使用解碼的金鑰，而沒有套用prepare_key驗證。當受信任的 JWK 集包含 k 值為空的 oct 項目時，就會發生這種情況。因此，攻擊者使用 PyJWT 接受的相同零長度金鑰簽署 HMAC 令牌。因此，偽造的權杖可以攜帶任意經過驗證的聲明。2.14.0 版已修正此問題。
    (CVE-2026-102266)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - PyJWT 是 JSON Web Token 标准的 Python 实现。由于 2.13.02.14.0PyJWK 验证路径使用了已解码的密钥，而没有应用prepare_key验证，因此 HMACAlgorithm.from_jwk受到影响。当受信任的 JWK Set 包含空 k 值的 oct 条目时，会发生这种情况。因此，攻击者以 PyJWT 接受的相同零长度密钥签署 HMAC 标记。结果，伪造的标记可携带任意经身份验证的声明。此问题已在 2.14.0 版本中修复。
    (CVE-2026-102266)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - PyJWT は、JSON Web トークン標準の Python 実装です。2.13.0から2.14.0までは、PyJWK検証パスがprepare_key検証を適用せずにデコードされたキーを使用したため、HMACAlgorithm.from_jwk影響を受けます。これは、信頼できるJWKセットに空のk値を持つoctエントリが含まれている場合に発生します。その結果、攻撃者はPyJWTが受け入れたのと同じゼロレングスの鍵でHMACトークンに署名します。その結果、偽造されたトークンは、任意の認証されたクレームを運ぶことができます。この問題はバージョン 2.14.0 で修正されています。
    (CVE-2026-102266)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0,     HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying     prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As     a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently,     forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.
    (CVE-2026-102266)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1087 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-102272:
    PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0,     HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize     accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with     a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-     key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge     authenticated tokens. This issue is fixed in version 2.14.0.

    CVE-2026-102268:
    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in     jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the     cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a     mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized     asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge     authenticated HMAC tokens. This issue is fixed in version 2.14.0.

    CVE-2026-102266:
    PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0,     HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying     prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As     a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently,     forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87004 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-gateway: authorization bypass via workload identity token forgery (CVE-2026-94416)
    * automation-platform-ui: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet     (CVE-2026-90711)
    * automation-platform-ui: compression: Denial of Service via memory leak on premature response close     (CVE-2026-87776)
    * automation-platform-ui: fflate: Denial of Service via crafted ZIP archives (CVE-2026-45820)
    * python3.12-pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary     file read and Pulp Container registry signing key theft (CVE-2026-90959)
    * python3.12-pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
    * python3.12-pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
    * python3.12-pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
    * python3.12-pyjwt: Authentication bypass via acceptance of DER public keys as HMAC secrets     (CVE-2026-102271)
    * python3.12-pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets     (CVE-2026-102273)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
465715	Echo: pyjwt: security update to 2.14.0	Tenable Cloud Security	Echo Local Security Checks	2026/10/2	2026/10/13	critical
465715	Echo: pyjwt: security update to 2.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/2	2026/10/13	critical
351337	Linux Distros 未修補弱點：CVE-2026-102266	Nessus	Misc.	2026/9/30	2026/10/22	critical
351337	Linux Distros 未修补的漏洞：CVE-2026-102266	Nessus	Misc.	2026/9/30	2026/10/22	critical
351337	Linux Distros のパッチ未適用の脆弱性: CVE-2026-102266	Nessus	Misc.	2026/9/30	2026/10/22	critical
351337	Linux Distros Unpatched Vulnerability : CVE-2026-102266	Nessus	Misc.	2026/9/30	2026/10/22	critical
365155	TencentOS Server 4: python-jwt (TSSA-2026:1087)	Nessus	Tencent Local Security Checks	2026/10/12	2026/10/12	critical
370142	RHEL 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:87004)	Nessus	Red Hat Local Security Checks	2026/10/21	2026/10/21	high

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

high