CVE-2026-22598

High

Published: 21/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

ManageIQ API before version radjabov-2 contains a flaw that allows creation of a malformed TimeProfile, causing later UI and API requests to timeout, leading to a Denial of Service.

Risk Assessment

Risk of denial of service affecting the management platform, potentially preventing administrators from accessing UI and API, impacting infrastructure management.

Recommendation

Upgrade ManageIQ to version radjabov-2 or apply the manual patch.

Other vulnerabilities in ManageIQ

CVE-2026-52903High
A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.

Original NVD description (English source)

ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created causing later UI and API requests to timeout leading to a Denial of Service. Version radjabov-2 contains a patch. One may also apply the patch manually.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS