There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0,
    HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize
    accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with
    a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-
    key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge
    authenticated tokens. This issue is fixed in version 2.14.0. (CVE-2026-102272)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - PyJWT 是 JSON Web 令牌標準的 Python 實作。從 2.13.0 直到 2.14.0，jwt/algorithms.py 中的HMACAlgorithm.prepare_key會受到影響，因為 raw-JWK 偵測器不會在檢查 JSON 之前正規化接受的 Unicode 位元組順序標記。當公用 JWK 以 UTF-8 BOM 為前置詞，並在混合演算法驗證路徑中使用時，就會發生這種情況。因此，公用 JWK 會繞過非對稱金鑰偵測，並成為 HMAC 密碼。因此，知道公開金鑰的攻擊者可以偽造經過身份驗證的權杖。2.14.0 版已修正此問題。(CVE-2026-102272)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - PyJWT 是 JSON Web Token 标准的 Python 实现。从 2.13.02.14.0until ， JWT/algorithms.py 中的 HMACAlgorithm.prepare_key 受到影响，因为 raw-JWK 检测器在检查 JSON 之前未规范化接受的 Unicode 字节顺序标记。当公共 JWK 以 UTF-8 BOM 作为前缀，并在混合算法验证路径中使用时，会发生这种情况。因此，公共 JWK 可绕过非对称密钥检测并成为 HMAC 密码。因此，了解公钥的攻击者可伪造经认证的标记。此问题已在 2.14.0 版本中修复。(CVE-2026-102272)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - PyJWT は、JSON Web トークン標準の Python 実装です。2.13.0から2.14.0までは、raw-JWK検出器がJSONをチェックする前に、受け入れられたUnicodeバイトオーダーのマークを正規化しないため、jwt/algorithms.py のHMACAlgorithm.prepare_keyが影響を受けます。これは、パブリック JWK に UTF-8 BOM のプレフィックスが付けられ、混合アルゴリズムの検証パスで使用されている場合に発生します。その結果、パブリック JWK は非対称鍵検出をバイパスし、HMAC シークレットになります。その結果、公開鍵を知っている攻撃者が、認証されたトークンを偽造する可能性があります。この問題はバージョン 2.14.0 で修正されています。(CVE-2026-102272)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1087 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-102272:
    PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0,     HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize     accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with     a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-     key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge     authenticated tokens. This issue is fixed in version 2.14.0.

    CVE-2026-102268:
    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in     jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the     cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a     mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized     asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge     authenticated HMAC tokens. This issue is fixed in version 2.14.0.

    CVE-2026-102266:
    PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0,     HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying     prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As     a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently,     forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0,     HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize     accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with     a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-     key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge     authenticated tokens. This issue is fixed in version 2.14.0. (CVE-2026-102272)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87004 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-gateway: authorization bypass via workload identity token forgery (CVE-2026-94416)
    * automation-platform-ui: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet     (CVE-2026-90711)
    * automation-platform-ui: compression: Denial of Service via memory leak on premature response close     (CVE-2026-87776)
    * automation-platform-ui: fflate: Denial of Service via crafted ZIP archives (CVE-2026-45820)
    * python3.12-pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary     file read and Pulp Container registry signing key theft (CVE-2026-90959)
    * python3.12-pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
    * python3.12-pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
    * python3.12-pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
    * python3.12-pyjwt: Authentication bypass via acceptance of DER public keys as HMAC secrets     (CVE-2026-102271)
    * python3.12-pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets     (CVE-2026-102273)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
459846	Echo: pyjwt: security update to 2.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/2	2026/10/13	high
459846	Echo: pyjwt: security update to 2.14.0	Tenable Cloud Security	Echo Local Security Checks	2026/10/2	2026/10/13	high
351387	Linux Distros 未修補弱點：CVE-2026-102272	Nessus	Misc.	2026/9/30	2026/10/22	high
351387	Linux Distros 未修补的漏洞：CVE-2026-102272	Nessus	Misc.	2026/9/30	2026/10/22	high
351387	Linux Distros のパッチ未適用の脆弱性: CVE-2026-102272	Nessus	Misc.	2026/9/30	2026/10/22	high
365155	TencentOS Server 4: python-jwt (TSSA-2026:1087)	Nessus	Tencent Local Security Checks	2026/10/12	2026/10/12	critical
351387	Linux Distros Unpatched Vulnerability : CVE-2026-102272	Nessus	Misc.	2026/9/30	2026/10/22	high
370142	RHEL 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:87004)	Nessus	Red Hat Local Security Checks	2026/10/21	2026/10/21	high

检测

插件搜索

high

high

high

high

high

critical

high

high