Remote Code Execution in ManageIQ via YAML Deserialization

Executive Summary

CVE-2026-52903 is a deserialization vulnerability in ManageIQ where the YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. This allows deserialization of arbitrary Ruby objects.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor ManageIQ logs for Psych::DisallowedClass errors followed by successful deserialization attempts. Check for unusual YAML parsing activity in production environments. Review dialog import access logs for unauthorized uploads of YAML files containing disallowed classes.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload. This could lead to unauthorized data modification, denial-of-service, or execution of malicious actions via Ruby gadget chains.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate compliance requirements under GDPR or HIPAA. Organizations using affected versions must mitigate the risk to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

• Remove or disable the Psych::DisallowedClass fallback in the YamlLoadAliases module to prevent silent fallback to YAML.unsafe_load.
• Restrict dialog import access to only trusted administrators to prevent unauthorized YAML uploads.
• Upgrade ManageIQ to a patched version if available, though Red Hat CloudForms is end-of-life and will not receive updates.

Useful 0 Not Useful 0