Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Red Hat CloudForms by Red Hat

    CVE-2026-52903 (GCVE-0-2026-52903)

    Vulnerability from nvd – Published: 2026-10-12 12:16 – Updated: 2026-10-12 12:16
    VLAI
    Title
    YAML safe_load production fallback to unsafe_load enables RCE via deserialization
    Summary
    A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    redhat CNA under the redhat root
    CNA scorecard B 81/100 over 979 records in the last 180 days details
    References
    Impacted products
    Credits
    Red Hat would like to thank Martin Brodeur (Fluentlogic) for reporting this issue.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/ManageIQ/manageiq",
          "defaultStatus": "affected",
          "packageName": "manageiq",
          "product": "ManageIQ",
          "vendor": "ManageIQ",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "packageName": "manageiq",
          "product": "Red Hat CloudForms",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Red Hat would like to thank Martin Brodeur (Fluentlogic) for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.\n\nRed Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T12:16:00.508Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-52903"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486730"
        }
      ],
      "title": "YAML safe_load production fallback to unsafe_load enables RCE via deserialization",
      "workarounds": [
        {
          "lang": "en",
          "value": "The following practices would help for avoiding exposure to this flaw:\n1) Remove or disable the rescue Psych::DisallowedClass fallback in lib/extensions/yaml_load_aliases.rb.\n2) Alternatively, restrict dialog import access to trusted administrators only."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-52903",
    "datePublished": "2026-10-12T12:16:00.508Z",
    "dateReserved": "2026-06-09T07:23:36.531Z",
    "dateUpdated": "2026-10-12T12:16:00.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-52903 (GCVE-0-2026-52903)

    Vulnerability from cvelistv5 – Published: 2026-10-12 12:16 – Updated: 2026-10-12 12:16
    VLAI
    Title
    YAML safe_load production fallback to unsafe_load enables RCE via deserialization
    Summary
    A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    redhat CNA under the redhat root
    CNA scorecard B 81/100 over 979 records in the last 180 days details
    References
    Impacted products
    Credits
    Red Hat would like to thank Martin Brodeur (Fluentlogic) for reporting this issue.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/ManageIQ/manageiq",
          "defaultStatus": "affected",
          "packageName": "manageiq",
          "product": "ManageIQ",
          "vendor": "ManageIQ",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "packageName": "manageiq",
          "product": "Red Hat CloudForms",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Red Hat would like to thank Martin Brodeur (Fluentlogic) for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.\n\nRed Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T12:16:00.508Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://access.redhat.com/security/cve/CVE-2026-52903"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486730"
        }
      ],
      "title": "YAML safe_load production fallback to unsafe_load enables RCE via deserialization",
      "workarounds": [
        {
          "lang": "en",
          "value": "The following practices would help for avoiding exposure to this flaw:\n1) Remove or disable the rescue Psych::DisallowedClass fallback in lib/extensions/yaml_load_aliases.rb.\n2) Alternatively, restrict dialog import access to trusted administrators only."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-52903",
    "datePublished": "2026-10-12T12:16:00.508Z",
    "dateReserved": "2026-06-09T07:23:36.531Z",
    "dateUpdated": "2026-10-12T12:16:00.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}