CVE-2026-46386CWE-1188CWE-1392CWE-502CWE-798

OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

Critical · published June 26, 2026

CVSS v3.1
9.9
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fixed in .

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00490 · 41.2th percentile
Weaknesses
CWE-1188 · Initialization of a Resource with an Insecure Default; CWE-1392 · Use of Default Credentials; CWE-502 · Deserialization of Untrusted Data; CWE-798 · Use of Hard-coded Credentials
Published
2026-06-26T19:26Z
EPSS history
Timeline
  • 26 JUN 19:26Z
    OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`
    cvelistv5