CVE-2026-52903

{
  "etk_id": "ETK-2026-1360",
  "cve_id": "CVE-2026-52903",
  "display_id": "CVE-2026-52903",
  "ghsa_id": "GHSA-rwm4-fgr7-vcr6",
  "euvd_id": "EUVD-2026-97362",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe YAML deserialization in ManageIQ",
  "summary": "ManageIQ can deserialize attacker-controlled YAML through its dialog import functionality under certain production error conditions. An authenticated user with dialog import access could execute code on the affected system by supplying malicious YAML.",
  "mitigation": "Restrict or disable dialog import access, and do not process YAML from untrusted sources. Review existing users and automation accounts for this permission and monitor imports until an upstream-fixed release is available.",
  "vendor": "ManageIQ",
  "product": "ManageIQ",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "manageiq",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0045,
  "epss_percentile": 0.3777,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 11.81364,
  "t0_at": "2026-10-12T12:16:00.508000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T13:28:37.255398+00:00",
      "days": 0.05042531710648148,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T12:16:00.508000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-12T12:16:00.508000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T12:16:00.508000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-52903"
    }
  }
}