Is CVE-2026-46386 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46386 being exploited in the wild.

How severe is CVE-2026-46386?

Critical severity, with a CVSS score of 9.9, published 26 June 2026.

Which products and versions are affected?

opf OpenProject >= 8.3.0, = 17.3.0, < 17.3.2; 17.4.0-dev.

Is there a fix for CVE-2026-46386?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-46386 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46386?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46386: OpenProject Remote Code Execution via Hardcoded Secret Key in Docker

Q: Is there a fix for CVE-2026-46386?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-46386 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-46386?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46386 · Severity: critical · CVSS 9.9 · Published 2026-06-26

OpenProject is a web-based project management platform. A security flaw in its official Docker images uses a predictable default security key, which can allow an attacker to take full control of the application. If self-registration is enabled, any person on the internet could potentially gain administrative access or execute malicious commands on the server, leading to total data exposure or service disruption.

Quick answers

Is CVE-2026-46386 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46386 being exploited in the wild.
How severe is CVE-2026-46386?: Critical severity, with a CVSS score of 9.9, published 26 June 2026.
Which products and versions are affected?: opf OpenProject >= 8.3.0, < 17.2.4; >= 17.3.0, < 17.3.2; 17.4.0-dev.
Is there a fix for CVE-2026-46386?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-46386 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46386?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The official OpenProject Docker image ships with a hardcoded default environment variable 'SECRET_KEY_BASE=OVERWRITE_ME'. When this default is not overridden by the administrator, the application uses a deterministic key to sign and encrypt cookies. Because the application was configured to use 'cookies_serializer = :marshal', an attacker who knows the secret key can craft a malicious cookie containing a serialized Ruby object. When the application processes this cookie (specifically via the /my/two_factor_devices endpoint), it triggers a deserialization vulnerability (CWE-502). This can be leveraged to achieve arbitrary object injection, such as creating an administrative user or executing OS commands as the Puma worker process. The vulnerability is pre-authentication if self-registration is enabled, or post-authentication for any low-privileged user otherwise. Fixes include mandatory validation of the secret key and switching the cookie serializer to JSON.

Affected products

opf OpenProject >= 8.3.0, < 17.2.4; >= 17.3.0, < 17.3.2; 17.4.0-dev

Timeline

2019-01-14: other: Hardcoded literal introduced in commit 57874efa23
2026-05-13: advisory: GitHub security advisory published by vendor
2026-06-26: disclosed: CVE published to NVD

References

https://github.com/opf/openproject/security/advisories/GHSA-r85r-gjq2-f83r

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.