Vulnerability · Published Jan 21, 2026 · Assigned by GitHub_M
CVE-2026-22598ManageIQ vulnerable to DoS Attack when creating TimeProfiles
High 7.1
In plain English
A high-severity improper input validation in manageiq from ManageIQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.4%top 65.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created causing later UI and API requests to timeout leading to a Denial of Service. Version radjabov-2 contains a patch. One may also apply the patch manually.
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/ManageIQ/manageiq/security/advisories/GHSA-m832-x3g8-63j3 x_refsource_CONFIRM
- https://github.com/ManageIQ/manageiq/commit/79cef10c7d0278d8a37c3f547c426948180df4df.patch x_refsource_MISC
- https://github.com/ManageIQ/manageiq/commit/86132851257d73ed9e31a88315e47a8a2b838113 x_refsource_MISC