Deserialization Vulnerability in ManageIQ by Red Hat

CVE-2026-52903

What is CVE-2026-52903?

A deserialization vulnerability has been identified in ManageIQ's YamlLoadAliases module that allows an authenticated attacker to exploit the system. When a Psych::DisallowedClass error occurs, the module bypasses YAML.safe_load and defaults to YAML.unsafe_load. This fallback mechanism enables attackers with dialog import access to upload specially crafted YAML payloads, leading to the deserialization and execution of arbitrary Ruby objects on the server. Additionally, it is important to note that Red Hat CloudForms, which is built on ManageIQ, has reached its End of Life and is no longer receiving support or patches, making the ManageIQ community especially vulnerable.

References