The vulnerability in ManageIQ arises from the YamlLoadAliases module overriding YAML.safe_load to silently switch to YAML.unsafe_load when a Psych::DisallowedClass exception is triggered in production. This behavior allows an authenticated attacker with dialog import rights to upload a malicious YAML document that activates the fallback and results in deserialization of arbitrary Ruby objects, leading to remote code execution. The flaw is a typical deserialization issue, categorized as CWE‑502, and requires legitimate import privileges rather than external network access to be exploited.

ManageIQ platforms and Red Hat CloudForms are affected. Vendor product names are supplied as ManageIQ:ManageIQ and Red Hat:Red Hat CloudForms; no specific version ranges are supplied, so any installation of these products that includes the YamlLoadAliases module and uses the default production configuration is potentially vulnerable.

The CVSS score of 8.8 places this issue in the high‑to‑critical range, and it is not yet listed in CISA’s KEV catalog. Although the EPSS score is not available, the combination of a high severity rating and the requirement for only authenticated import privileges gives the vulnerability a notable risk of exploitation. Attackers must first attain dialog import access, then upload a malicious YAML document, after which the unsafe load causes arbitrary code execution on the host running ManageIQ. The absence of mitigations in the default configuration makes exploitation straightforward for any privileged user.