Tanzu Operations Manager assessment for CVE-2026-66066

Products

• Operations Manager

Issue/Introduction

Security scanners may report CVE-2026-66066 against Tanzu Operations Manager VMs. This CVE is related to a vulnerability in the Ruby on Rails framework, specifically concerning the Active Storage variant processor. Customers may be concerned about the potential risk and the availability of a fix.

Environment

Tanzu Operations Manager Versions: 3.1.x, 3.3.x

Resolution

Broadcom Engineering has confirmed that Tanzu Operations Manager is not vulnerable to CVE-2026-66066.

The vulnerability requires the Ruby on Rails variant_processor feature to be enabled. In Tanzu Operations Manager, this feature is explicitly disabled within the application configuration to ensure security and stability.

Technical Detail: In the Ops Manager web configuration (/home/tempest-web/uoa/config/application.rb), the following setting is applied: config.active_storage.variant_processor = :disabled

Because this code path is inactive, the vulnerability cannot be exploited on the Ops Manager appliance.

Remediation

While the product is not vulnerable, updated Ruby on Rails binaries will be included in the standard maintenance cycle to ensure security scanner compliance.

• Fixed Versions: The August 2026 patch releases for Tanzu Operations Manager 3.1 and 3.3 will include the updated Rails version.
• Action Required: No immediate action is required due to the existing mitigation. Customers should upgrade to the August maintenance releases once they become available on the Broadcom Support Portal.