CVE-2026-46386 Details
Description
OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fixed in .
A vulnerability exists in the official OpenProject Docker image versions 8.3.0 prior to 17.3.1, as well as in release 17.4 and the development version. The issue arises because the default Rails master key is set to 'OVERWRITE_ME', which, when combined with a cookie serializer that uses Marshal, creates a predictable path for deserializing cookies. This vulnerability allows any logged-in user to execute a chain of actions that could lead to remote code execution on the server.
Users of the OpenProject Docker image must set a proper SECRET_KEY_BASE environment variable before starting the application. If this variable is not set, the application will not boot. After updating the SECRET_KEY_BASE, users will need to re-authenticate for two-factor authentication.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opf/openproject/security/advisories/GHSA-r85r-gjq2-f83r | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-1392 | Use of Default Credentials | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenProject | >= 8.3.0, <= 17.3.1 (semver) release/17.4 dev |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |