There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT
    HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are
    absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and
    supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an
    HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This
    issue is fixed in version 2.14.0. (CVE-2026-102271)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - PyJWT 是 JSON Web 令牌標準的 Python 實作。從 2.4.0 直到 2.14.0，PyJWT HMACAlgorithm.prepare_key 會受到影響，因為非對稱金鑰保護依賴 DER 編碼中沒有的文字標記。當應用程式混合 HMAC 和非對稱演算法，並提供 DER 公開金鑰作為共用驗證金鑰時，就會發生這種情況。因此，PyJWT 使用公共 DER 位元組作為 HMAC 密碼。因此，知道公開金鑰的攻擊者可以偽造經過身份驗證的 HMAC 權杖。2.14.0 版已修正此問題。(CVE-2026-102271)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - PyJWT 是 JSON Web Token 标准的 Python 实现。From 2.4.02.14.0until ， PyJWT HMACAlgorithm.prepare_key 会受到影响，因为 asymmetric-key guard 依赖于 DER 编码中不存在的文本标记。当应用程序混合使用 HMAC 和非对称算法并提供 DER 公钥作为共享验证密钥时，会发生这种情况。因此，PyJWT 将公共 DER 字节用作 HMAC 密码。因此，了解公钥的攻击者可伪造经认证的 HMAC 标记。此问题已在 2.14.0 版本中修复。(CVE-2026-102271)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - PyJWT は、JSON Web トークン標準の Python 実装です。2.4.0から2.14.0まで、PyJWT HMACAlgorithm.prepare_keyは影響を受けます。これは、非対称キーガードがDERエンコーディングから欠落したテキストマーカーに依存しているためです。これは、アプリケーションが HMAC と非対称アルゴリズムを混合し、DER 公開鍵を共有検証鍵として提供した場合に発生します。その結果、PyJWTはパブリックDERバイトをHMACシークレットとして使用します。その結果、公開鍵を知っている攻撃者が、認証されたHMACトークンを偽造する可能性があります。この問題はバージョン 2.14.0 で修正されています。(CVE-2026-102271)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT     HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are     absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and     supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an     HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This     issue is fixed in version 2.14.0. (CVE-2026-102271)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87004 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-gateway: authorization bypass via workload identity token forgery (CVE-2026-94416)
    * automation-platform-ui: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet     (CVE-2026-90711)
    * automation-platform-ui: compression: Denial of Service via memory leak on premature response close     (CVE-2026-87776)
    * automation-platform-ui: fflate: Denial of Service via crafted ZIP archives (CVE-2026-45820)
    * python3.12-pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary     file read and Pulp Container registry signing key theft (CVE-2026-90959)
    * python3.12-pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
    * python3.12-pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
    * python3.12-pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
    * python3.12-pyjwt: Authentication bypass via acceptance of DER public keys as HMAC secrets     (CVE-2026-102271)
    * python3.12-pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets     (CVE-2026-102273)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
459398	Echo: pyjwt: security update to 2.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/2	2026/10/13	high
459398	Echo: pyjwt: security update to 2.14.0	Tenable Cloud Security	Echo Local Security Checks	2026/10/2	2026/10/13	high
351376	Linux Distros 未修補弱點：CVE-2026-102271	Nessus	Misc.	2026/9/30	2026/10/12	high
351376	Linux Distros 未修补的漏洞：CVE-2026-102271	Nessus	Misc.	2026/9/30	2026/10/12	high
351376	Linux Distros のパッチ未適用の脆弱性: CVE-2026-102271	Nessus	Misc.	2026/9/30	2026/10/12	high
351376	Linux Distros Unpatched Vulnerability : CVE-2026-102271	Nessus	Misc.	2026/9/30	2026/10/12	high
370142	RHEL 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:87004)	Nessus	Red Hat Local Security Checks	2026/10/21	2026/10/21	high

检测

插件搜索

high

high

high

high

high

high

high