Bug 2486730 (CVE-2026-52903)

Summary: CVE-2026-52903 manageiq: YAML safe_load production fallback to unsafe_load enables RCE via deserialization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-09 07:26:00 UTC 
A deserialization vulnerability was found in ManageIQ. The YamlLoadAliases module in lib/extensions/yaml_load_aliases.rb overrides YAML.safe_load globally. When a Psych::DisallowedClass error is raised in production, instead of raising the error, it silently falls back to YAML.unsafe_load, which deserializes arbitrary Ruby objects. An authenticated user with dialog import access can upload a crafted YAML payload containing classes outside the permitted list to trigger the fallback and achieve Remote Code Execution via standard Ruby gadget chains.

The code comment explicitly labels this a "Temporary hack to fallback to psych 3 behavior" but it was never removed.