{"id":"CVE-2026-52903","published":"2026-10-12T13:17:32.757","lastModified":"2026-10-14T20:13:37.910","description":"A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.\n\nRed Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-52903","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486730","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"ManageIQ contains a deserialization vulnerability where untrusted YAML data is silently converted to unsafe loading, allowing authenticated attackers to execute arbitrary code through crafted YAML payloads. This affects systems using the YamlLoadAliases module and can lead to full system compromise.","exploitability":"Exploitation requires an authenticated user with dialog import access, making it moderately difficult but achievable through social engineering or compromised credentials, with no additional preconditions beyond standard authentication.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the target system, potentially leading to complete system compromise and data exfiltration across all managed resources.","remediation":"Disable the dialog import functionality immediately, as no patches or errata are available for ManageIQ or CloudForms due to its End of Life status.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","yaml","rce","authenticated","manageiq"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:52:57.703Z"}}