{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amanageiqmanageiq/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:manageiq:manageiq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-52903"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ManageIQ","CloudForms"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ManageIQ","Red Hat"],"content_html":"\u003cp\u003eManageIQ contains a critical deserialization of untrusted data vulnerability, tracked as CVE-2026-52903. The vulnerability exists within the YamlLoadAliases module, which is designed to handle YAML parsing. In production environments, the module is configured to silently fall back from \u003ccode\u003eYAML.safe_load\u003c/code\u003e to \u003ccode\u003eYAML.unsafe_load\u003c/code\u003e whenever a \u003ccode\u003ePsych::DisallowedClass\u003c/code\u003e exception occurs.\u003c/p\u003e\n\u003cp\u003eAn authenticated attacker possessing dialog import privileges can leverage this behavior by uploading a specifically crafted YAML file. When the application processes this payload, it triggers the exception, engages the insecure fallback mechanism, and deserializes arbitrary Ruby objects, resulting in remote code execution. This issue affects ManageIQ installations and legacy downstream distributions like Red Hat CloudForms. Given that Red Hat CloudForms is at End of Life and receives no further security support, users must apply mitigations or patches provided by the ManageIQ community to prevent exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability permits an authenticated attacker to execute arbitrary Ruby code on the underlying ManageIQ server. This can lead to full system compromise, exfiltration of sensitive configuration data, or lateral movement within the environment. While the vulnerability requires authentication, the impact is severe, particularly in enterprise management environments where ManageIQ often maintains high-privilege access to managed infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the official patch or upgrade ManageIQ to a version containing the security fix for CVE-2026-52903.\u003c/li\u003e\n\u003cli\u003eFor legacy Red Hat CloudForms installations, immediately isolate the management interface from non-trusted networks, as no official vendor patches will be released.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and access control for the dialog import feature to ensure only authorized personnel can perform import operations.\u003c/li\u003e\n\u003cli\u003eAudit logs for unauthorized or unexpected modifications to management dialogs or anomalous ruby process activity following file uploads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T13:44:35Z","date_published":"2026-10-12T13:44:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-manageiq-deserialization/","summary":"An authenticated deserialization vulnerability in the ManageIQ YamlLoadAliases module allows attackers to achieve remote code execution by exploiting a silent fallback to unsafe YAML loading.","title":"Remote Code Execution in ManageIQ via YAML Deserialization","url":"https://feed.craftedsignal.io/briefs/2026-10-manageiq-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:manageiq:manageiq:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}