The vulnerability in ManageIQ occurs when the YamlLoadAliases module silently substitutes YAML.safe_load with YAML.unsafe_load after a Psych::DisallowedClass error in production. This override permits the deserialization of arbitrary Ruby objects when an authenticated attacker with dialog import access uploads a crafted YAML payload, enabling remote code execution. The flaw represents a classic deserialization weakness, identified as CWE‑502, where untrusted data is materialized into executable code. The attack requires legitimate import privileges but does not rely on arbitrary network exposure, making it an authenticated exploitation scenario.

ManageIQ platforms are affected. No specific vendor product names or version ranges are supplied in the data, so any installation of ManageIQ that includes the YamlLoadAliases module and uses the default production configuration is potentially vulnerable.

The CVSS score of 8.8 places this issue in the high‑to‑critical range, and it is not yet listed in CISA’s KEV catalog. Although the EPSS score is not available, the combination of a high severity rating and the requirement for only authenticated import privileges gives the vulnerability a notable risk of exploitation. Attackers must first attain dialog import access, then upload a malicious YAML document, after which the unsafe load causes arbitrary code execution on the host running ManageIQ. The absence of mitigations in the default configuration makes exploitation straightforward for any privileged user.