What is the CVSS score of CVE-2026-46386?

CVE-2026-46386 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of OpenProject are affected by CVE-2026-46386?

The official openproject/openproject Docker image contains a critical remote code execution vulnerability (CVSS 9.9) stemming from a hardcoded Rails secret combined with unsafe cookie…. A patch is available.

How to fix or mitigate CVE-2026-46386?

Within 24 hours: Cease use of unmodified openproject/openproject Docker image; immediately override the hardcoded SECRET_KEY_BASE environment variable with a cryptographically random value of minimum 32 bytes. Within 7 days: Audit all running instances to confirm SECRET_KEY_BASE override is deployed, review authentication logs for suspicious session activity, and rotate credentials for all user accounts. Within 30 days: Monitor official OpenProject security advisories for patch availability; if patch not released, evaluate alternative deployment methods (direct installation with hardened configuration, containerization with enforced environment variable overrides).

OpenProject CVE-2026-46386

EUVD-2026-39875 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-26 GitHub_M

Deserialization Docker Openproject

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable cookie endpoint (AV:N), low complexity since the key is a known constant (AC:L), any authenticated user suffices (PR:L), Marshal RCE escapes the app sandbox (S:C) giving full C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 20:30 vuln.today

CVE Published

Jun 26, 2026 - 19:26 cve.org

CRITICAL 9.9

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fixed in .

Articles & Coverage 1

News Critical RCE in OpenProject Docker Image via Hardcoded Secret - CVE-2026-46386 Jun 27, 2026

AnalysisAI

Authenticated remote code execution affects the official openproject/openproject Docker image, which ships with a hardcoded Rails secret (ENV SECRET_KEY_BASE=OVERWRITE_ME). Because the application uses cookies_serializer = :marshal, any logged-in user who knows this deterministic key can forge a signed cookie containing a malicious Marshal payload that is deserialized when reaching the /my/two_factor_devices cookie reader, yielding code execution on the server (CVSS 9.9, scope-changed). At the time of analysis there is no public exploit identified and the issue is not in CISA KEV, but the predictability of the default key makes exploitation straightforward for anyone running an unmodified image.

Technical ContextAI

OpenProject is a Ruby on Rails web-based project management platform. In Rails, SECRET_KEY_BASE is the master secret used to sign and (with the legacy Marshal serializer) encrypt session and signed cookies; if it is known, an attacker can mint cookies the server will trust. The vulnerable configuration combines a publicly known default key shipped in the Docker image (SECRET_KEY_BASE=OVERWRITE_ME, intended to be overwritten by operators) with cookies_serializer = :marshal, which calls Ruby's Marshal.load on attacker-influenced cookie data. This is a textbook CWE-502 (Deserialization of Untrusted Data) issue: Marshal.load on attacker-controlled bytes instantiates arbitrary Ruby objects and can be chained into gadget-based remote code execution. The affected product per CPE is cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:* - i.e. OpenProject deployed from the official container image without overriding the key.

RemediationAI

Patch available per vendor advisory: upgrade to the fixed OpenProject release referenced in GHSA-r85r-gjq2-f83r (https://github.com/opf/openproject/security/advisories/GHSA-r85r-gjq2-f83r); the exact patched version number was not provided in the available data, so confirm it directly from that advisory before deploying. As an immediate compensating control that does not require an upgrade, override the default master key by setting a unique, high-entropy SECRET_KEY_BASE (e.g. via the OPENPROJECT_SECRET_KEY_BASE / SECRET_KEY_BASE environment variable or secrets manager) so the OVERWRITE_ME value is never used - this directly removes the deterministic-key prerequisite, though it will invalidate existing sessions and signed cookies, forcing users to re-authenticate. Where feasible, also restrict who can obtain a login (the attack needs an authenticated account) and place the instance behind network access controls to reduce the pool of potential attackers; note these reduce but do not eliminate risk while the default key remains in place.