Executive brief
OpenProject is a web-based project management platform. A security flaw in its official Docker images uses a predictable default security key, which can allow an attacker to take full control of the application. If self-registration is enabled, any person on the internet could potentially gain administrative access or execute malicious commands on the server, leading to total data exposure or service disruption.
Technical details
The official OpenProject Docker image ships with a hardcoded default environment variable 'SECRET_KEY_BASE=OVERWRITE_ME'. When this default is not overridden by the administrator, the application uses a deterministic key to sign and encrypt cookies. Because the application was configured to use 'cookies_serializer = :marshal', an attacker who knows the secret key can craft a malicious cookie containing a serialized Ruby object. When the application processes this cookie (specifically via the /my/two_factor_devices endpoint), it triggers a deserialization vulnerability (CWE-502). This can be leveraged to achieve arbitrary object injection, such as creating an administrative user or executing OS commands as the Puma worker process. The vulnerability is pre-authentication if self-registration is enabled, or post-authentication for any low-privileged user otherwise. Fixes include mandatory validation of the secret key and switching the cookie serializer to JSON.
Affected products
- opf OpenProject >= 8.3.0, < 17.2.4; >= 17.3.0, < 17.3.2; 17.4.0-dev
Timeline
- 2019-01-14: other: Hardcoded literal introduced in commit 57874efa23
- 2026-05-13: advisory: GitHub security advisory published by vendor
- 2026-06-26: disclosed: CVE published to NVD