CVE-2026-46386 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-46386 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-46386 is a critical OpenProject vulnerability (CVSS 9.9) that can let a logged-in user reach a deterministic Marshal-deserialization path because the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key, and cookies_serializer = :marshal is enabled. In practice, this means a low-privilege authenticated user may be able to trigger unsafe deserialization through the /my/two_factor_devices cookie reader and potentially achieve code execution or full application compromise.

KEV status: Not in CISA KEV. Exploited in the wild: No known public exploitation at this time. Action still required now: critical flaws like this are often weaponized quickly once details are public.

Immediate Action

  • Upgrade immediately to the first fixed OpenProject release. If you do not know the safe version yet, use the vendor advisory and release notes: OpenProject security advisory.
  • Stop using the vulnerable Docker image tag if it bakes in the default SECRET_KEY_BASE. Pull a patched image only after confirming the fix is included.
  • Rotate secrets used by OpenProject, especially SECRET_KEY_BASE, session signing keys, and any credentials stored alongside the app.
  • Restrict access to the app while patching: limit to VPN/admin IPs, or temporarily isolate the service from the internet if business impact allows.
  • Invalidate sessions after upgrade so any potentially crafted cookies are no longer useful.
  • Review logs for unusual requests to /my/two_factor_devices, repeated cookie errors, or unexpected 500s around authentication flows.

Affected Versions

  • openproject/openproject Docker image versions prior to TODO_FIXED_VERSION are vulnerable.
  • Any deployment using the official image with the default ENV SECRET_KEY_BASE=OVERWRITE_ME and cookies_serializer = :marshal should be treated as vulnerable until confirmed patched.
  • Safe version: upgrade to TODO_FIXED_VERSION or later.
  • If you build from source: ensure your release includes the fix for the default master key and removes Marshal-based cookie deserialization exposure.

Resolution Guide

Docker:

# Pull the patched image once you know the fixed tag
docker pull openproject/openproject:TODO_FIXED_VERSION

# Stop and replace the old container
docker stop openproject
docker rm openproject

docker run -d --name openproject \
  -e SECRET_KEY_BASE="$(openssl rand -hex 64)" \
  -p 8080:80 \
  openproject/openproject:TODO_FIXED_VERSION

Docker Compose hardening:

services:
  openproject:
    image: openproject/openproject:TODO_FIXED_VERSION
    environment:
      SECRET_KEY_BASE: "${OPENPROJECT_SECRET_KEY_BASE}"
      RAILS_ENV: production

Rails config hardening example:

# config/initializers/cookies_serializer.rb
Rails.application.config.action_dispatch.cookies_serializer = :json

Minimal code fix example:

# Avoid Marshal for cookies
# BEFORE:
# config.action_dispatch.cookies_serializer = :marshal

# AFTER:
config.action_dispatch.cookies_serializer = :json

Package managers: OpenProject is typically deployed as a Docker image, not via npm/pip/Maven. If your internal wrapper or deployment tooling pins the image tag, update that reference directly. Example:

# Kubernetes / Helm values
image:
  repository: openproject/openproject
  tag: TODO_FIXED_VERSION

Linux package systems: If your environment installs OpenProject through a distro package or custom repo, update to the vendor’s patched package version:

# Debian/Ubuntu
sudo apt update
sudo apt install --only-upgrade openproject

# RHEL/CentOS/Fedora
sudo yum update openproject
# or
sudo dnf update openproject

Detection & Verification

Check whether you are vulnerable:

# Inspect the running image tag
docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'

# Look for the default secret in image/env config
docker exec -it openproject sh -lc 'env | grep -E "SECRET_KEY_BASE|RAILS_ENV"'

# Search config for Marshal cookie serializer
docker exec -it openproject sh -lc 'grep -R "cookies_serializer.*marshal\|cookies_serializer *= *:marshal" -n /app /usr/src/app 2>/dev/null'

File grep on source deployments:

grep -R "SECRET_KEY_BASE=OVERWRITE_ME\|cookies_serializer.*marshal" -n .

Dependency / image audit:

# If you track container images in CI
trivy image openproject/openproject:TODO_FIXED_VERSION
grype openproject/openproject:TODO_FIXED_VERSION

# If you use SBOM or policy checks
syft openproject/openproject:TODO_FIXED_VERSION

Verify the fix:

# Confirm the patched tag is deployed
docker inspect openproject --format '{{.Config.Image}}'

# Confirm the secret is no longer the default placeholder
docker exec -it openproject sh -lc 'test "$SECRET_KEY_BASE" != "OVERWRITE_ME" && echo "secret ok"'

# Confirm cookies are JSON, not Marshal
docker exec -it openproject sh -lc 'grep -R "cookies_serializer.*json" -n /app /usr/src/app 2>/dev/null'

Risk and Impact

This issue can turn a normal authenticated session into a path toward unsafe object deserialization, which may lead to remote code execution, data theft, or full takeover of the OpenProject instance. For solo developers and small teams, the blast radius can include project plans, credentials, API tokens, and internal notes stored in the application. If the service is internet-facing, assume the window for abuse is short once attackers begin scanning for exposed instances.

Bottom line: patch now, rotate secrets, and remove any deployment that still relies on the default OpenProject master key or Marshal cookie handling.

Keep reading