CVE-2026-71238: DjangoCRM: Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery
DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover. The repository also ships with DEBUG=True as the default, causing error pages to leak database credentials, email credentials, OAuth data, and internal file paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the hardcoded Django SECRET_KEY from committed webcrm/settings.py and configure Django to read SECRET_KEY from an environment variable instead, then restart the application.
DjangoCRM (webcrm/settings.py) SECRET_KEY = (remove hardcoded value; use a securely generated environment variable) - Configuration
Change the default DEBUG=True to DEBUG=False to prevent error pages from leaking database credentials, email credentials, OAuth data, and internal file paths.
DjangoCRM (Django settings) DEBUG = False - Operational
After updating SECRET_KEY handling, rotate any exposed secrets (e.g., any session/CSRF/password-reset tokens that could have been forged) and ensure the new SECRET_KEY is in use.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71238?
CVE-2026-71238 has a critical severity score of 9.1.
How do I fix CVE-2026-71238?
To fix CVE-2026-71238, remove the hardcoded SECRET_KEY from webcrm/settings.py and use an environment variable to set the key.
What impact does CVE-2026-71238 have?
CVE-2026-71238 allows attackers to forge valid session tokens and CSRF tokens, compromising user sessions and security.
Is CVE-2026-71238 exploitable?
Yes, CVE-2026-71238 is exploitable as it exposes the hardcoded SECRET_KEY to anyone with access to the public repository.
Which software is affected by CVE-2026-71238?
CVE-2026-71238 affects DjangoCRM due to the hardcoded SECRET_KEY in its settings.