Answer in brief
CVE-2026-52903 records a High severity (CVSS 8.8) vulnerability in YAML safe_load production fallback to unsafe_load enables RCE via deserialization. The current sources do not mark it as known exploited. The current feed maps ManageIQ/manageiq (generic), Red Hat/Red Hat CloudForms (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ManageIQ/manageiq (generic), Red Hat/Red Hat CloudForms (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ManageIQ/manageiqgeneric | * | Not reported |
| Red Hat/Red Hat CloudFormsgeneric | * | Not reported |
Published upstream
Oct 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 12, 2026
A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.
Quoted source text, attributed separately from HOL analysis.