Description

A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-12T13:17:32.757Z",
  "pubdate": "2026-10-12T13:17:32.757Z",
  "executiveSummary": "A critical deserialization of untrusted data vulnerability exists in the YamlLoadAliases module within ManageIQ.\nThe vulnerability allows an authenticated attacker to achieve remote code execution (RCE) by manipulating the application's YAML processing logic.\nBy triggering a Psych::DisallowedClass exception, the application incorrectly falls back to an unsafe deserialization method, bypassing security restrictions.\nThe vulnerability affects ManageIQ and its derivative, Red Hat CloudForms, which has reached end-of-life status.\nExploitation requires an attacker to possess authenticated access to the dialog import functionality.\nSuccessful exploitation results in arbitrary Ruby object deserialization, granting the attacker the ability to execute malicious code within the context of the application process.\nGiven that Red Hat CloudForms is no longer supported, users are at significant risk as no official vendor patches will be provided, necessitating immediate manual intervention by the ManageIQ community and downstream consumers.",
  "technicalDetails": "The vulnerability originates in the YamlLoadAliases module, which serves as a wrapper for Ruby's Psych YAML parser. Under standard security configurations, ManageIQ intends to utilize YAML.safe_load to prevent the instantiation of arbitrary classes during deserialization.\nThe root cause is a flawed error-handling mechanism within YamlLoadAliases. When a Psych::DisallowedClass exception is raised—signifying that the input contains forbidden classes—the module intercepts the error and silently reverts to YAML.unsafe_load. This fallback mechanism effectively nullifies the security constraints of safe_load, allowing the parser to instantiate arbitrary Ruby objects defined in the YAML stream.\nThe attack vector involves the dialog import functionality, which accepts user-supplied YAML data. An authenticated attacker can craft a malicious YAML payload designed to trigger the Psych::DisallowedClass exception. Upon encountering this error, the application's faulty logic forces the use of YAML.unsafe_load to process the remainder of the payload.\nThe exploitation flow is as follows: 1) The attacker authenticates to the ManageIQ interface and navigates to the dialog import feature. 2) The attacker uploads a crafted YAML file containing an object chain capable of remote code execution. 3) The YamlLoadAliases module attempts to process the file using YAML.safe_load. 4) The parser rejects the malicious objects, raising a Psych::DisallowedClass error. 5) The catch block in YamlLoadAliases catches the exception and proceeds to invoke YAML.unsafe_load. 6) The unsafe loader deserializes the malicious object graph, executing the attacker's arbitrary Ruby code within the application process.\nBecause the payload is deserialized directly by the application runtime, the impact includes full remote code execution. This allows the attacker to read, modify, or delete sensitive system files, interact with the underlying operating system, or pivot further into the infrastructure. The vulnerability is particularly severe because it transforms a security-focused exception handler into an entry point for arbitrary code execution. As Red Hat CloudForms is deprecated and no longer receives updates, downstream consumers must implement defensive wrappers or custom code modifications to prevent the unsafe fallback mechanism from executing."
}