The fence-agents package in Red Hat Enterprise Linux 9 contains two vulnerabilities related to the Jinja templating engine sandbox breakout. CVE-2024-56201 allows sandbox escape through malicious filenames, while CVE-2024-56326 involves sandbox breakout via indirect reference to the format method. These vulnerabilities could potentially allow an attacker to bypass sandbox restrictions within fence-agents scripts that manage remote power operations for cluster nodes. Red Hat has released security updates as detailed in advisory RHSA-2025:0308 to remediate these issues across multiple RHEL 9 variants and related cluster management products.

Successful exploitation of these vulnerabilities could allow an attacker to escape the Jinja sandbox environment within fence-agents scripts. Since fence-agents control remote power management and cluster node fencing, this could lead to unauthorized actions affecting cluster stability and node management. However, no known exploits in the wild have been reported. The impact is considered high due to the critical role of fence-agents in cluster environments and the potential for privilege escalation or unauthorized command execution within the cluster management context.

Red Hat has released official security updates addressing these vulnerabilities in fence-agents as described in advisory RHSA-2025:0308. Administrators should apply the provided updates promptly to affected Red Hat Enterprise Linux 9 systems and related products. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.