A deserialization of untrusted data vulnerability was found in ManageIQ. (CVE-2026-52903)

The vulnerability arises from the YamlLoadAliases module in ManageIQ, which overrides the safe YAML deserialization method to fallback silently to an unsafe method when a Psych::DisallowedClass error occurs. This fallback allows an authenticated attacker with dialog import privileges to upload a malicious YAML payload that triggers the unsafe deserialization of arbitrary Ruby objects, resulting in remote code execution. Red Hat CloudForms, a derivative product, is no longer supported and will not receive patches. No patch or remediation is currently available for ManageIQ as per the provided data.

Successful exploitation allows an authenticated attacker with dialog import access to execute arbitrary code remotely on the affected ManageIQ system. This can lead to full system compromise, data loss, or further lateral movement within the environment. The vulnerability has a high CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability.

No official patch or fix is currently available for this vulnerability. Red Hat CloudForms is end-of-life and will not receive updates. Users of ManageIQ should consider restricting dialog import access to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.