CVE-2026-46386: OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`
OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/twofactordevices cookie reader This vulnerability is fixed in .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the container ENV SECRET_KEY_BASE from the shipped default value SECRET_KEY_BASE=OVERWRITE_ME to a non-default, unique value.
OpenProject (Rails) in openproject/openproject Docker image SECRET_KEY_BASE = (do not use default) OVERWRITE_ME - Configuration
Do not use the insecure cookie serializer setting cookies_serializer = :marshal; change it to a safer serializer so cookies cannot be deterministically deserialized via Marshal-deserialization.
OpenProject (Rails) cookie deserialization cookies_serializer = :marshal
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46386?
CVE-2026-46386 has a critical severity rating of 9.9.
How can I fix CVE-2026-46386?
To fix CVE-2026-46386, update the openproject/openproject Docker image to ensure the SECRET_KEY_BASE is set to a secure and unique value.
What type of vulnerability is CVE-2026-46386?
CVE-2026-46386 is a pre-authentication remote code execution (RCE) vulnerability.
Who is affected by CVE-2026-46386?
Users of the openproject/openproject Docker image are affected by CVE-2026-46386.
What are the consequences of exploiting CVE-2026-46386?
Exploiting CVE-2026-46386 can lead to full system compromise due to remote code execution.