ManageIQ: Remote code execution via YAML deserialization fallback
Summary
ManageIQ's YamlLoadAliases module falls back from YAML.safe_load to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated user with dialog import access can upload a crafted YAML payload that deserializes arbitrary Ruby objects and achieves remote code execution. Red Hat CloudForms, which was based on ManageIQ, is also listed as affected, but it has reached End of Life and will receive no patches.
Affected
Unknown. ManageIQ installations that include the YamlLoadAliases module in the default production configuration are potentially affected.
- Red Hat CloudForms (based on ManageIQ) is listed as affected.
Fixed in
Unknown. No fixed ManageIQ release has been identified.
- Red Hat CloudForms: no fix will be issued, as the product has reached End of Life.
Workaround
- Remove or disable the rescue Psych::DisallowedClass fallback in lib/extensions/yaml_load_aliases.rb (test first).
- Restrict dialog import access to trusted administrators only.
Exploitation
- Exploited in the wild: no evidence found.
- Not listed in CISA KEV.
- No public proof of concept found in the sources.
- EPSS: 0.00447 (low).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether ManageIQ or CloudForms is deployed and which version is running.
- Review who holds dialog import rights and remove them where not needed.
- Confirm that the management interface is not reachable from the internet.
- Apply the code workaround on upstream ManageIQ after testing, and monitor the ManageIQ project and Red Hat Bugzilla for a fixed release.
- For CloudForms, plan a migration, since no fix will be released.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-52903 access.redhat.com
- Red Hat Bugzilla 2486730 bugzilla.redhat.com
- OSV entry CVE-2026-52903 osv.dev
- OpenCVE CVE-2026-52903 app.opencve.io
- ManageIQ issue 24038 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:31.
Original description (NVD)
A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.