CVE-2026-71238: DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery
DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the hardcoded Django SECRET_KEY from committed webcrm/settings.py and configure the application to read SECRET_KEY from an environment variable instead.
DjangoCRM (Django app) - webcrm/settings.py SECRET_KEY = REPLACE hardcoded value with environment variable (load SECRET_KEY from env) - Operational
After changing SECRET_KEY, invalidate any existing sessions and rotate any tokens that may have been forged/issued previously (e.g., require users to log in again; ensure password reset tokens cannot be reused).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71238?
CVE-2026-71238 has a critical severity score of 9.1.
How do I fix CVE-2026-71238?
To fix CVE-2026-71238, remove the hardcoded SECRET_KEY from webcrm/settings.py and use an environment variable to set the key.
What impact does CVE-2026-71238 have?
CVE-2026-71238 allows attackers to forge valid session tokens and CSRF tokens, compromising user sessions and security.
Is CVE-2026-71238 exploitable?
Yes, CVE-2026-71238 is exploitable as it exposes the hardcoded SECRET_KEY to anyone with access to the public repository.
Which software is affected by CVE-2026-71238?
CVE-2026-71238 affects DjangoCRM due to the hardcoded SECRET_KEY in its settings.