CVE-2026-46386: OpenProject RCE Vulnerability

CVE-2026-46386 Overview

CVE-2026-46386 is an insecure deserialization vulnerability in OpenProject, an open-source, web-based project management application. The official openproject/openproject Docker image ships with ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, any authenticated user can forge a signed cookie that triggers Marshal deserialization. The /my/two_factor_devices cookie reader provides a deterministic path to arbitrary object instantiation and remote code execution [CWE-502].

Critical Impact
Authenticated attackers can achieve remote code execution on any OpenProject Docker deployment that retains the default SECRET_KEY_BASE value, resulting in full compromise of the application server.

Affected Products

OpenProject official Docker image (openproject/openproject)
Deployments using the default SECRET_KEY_BASE=OVERWRITE_ME environment value
Instances configured with cookies_serializer = :marshal

Discovery Timeline

2026-06-26 - CVE-2026-46386 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-46386

Vulnerability Analysis

OpenProject is a Ruby on Rails application. Rails uses SECRET_KEY_BASE to derive keys that sign and encrypt session cookies. When the value is publicly known, attackers can produce valid signed cookies containing attacker-controlled payloads.

The official Docker image sets SECRET_KEY_BASE=OVERWRITE_ME as a placeholder default. Operators are expected to override this value, but instances that do not inherit a predictable, public secret. Any party can generate cookies that Rails will accept as authentic.

The application also configures cookies_serializer = :marshal. Rails deserializes signed cookie contents using Ruby's Marshal.load, which instantiates arbitrary Ruby objects from serialized data. Marshal deserialization of untrusted data enables gadget-chain execution leading to arbitrary command execution.

Root Cause

The root cause is a combination of a hardcoded default cryptographic secret and use of the unsafe Marshal serializer for cookies. Both conditions are present in the shipped Docker image, so any deployment that fails to override SECRET_KEY_BASE is exploitable.

Attack Vector

An authenticated user requests /my/two_factor_devices with a forged cookie signed using the known default key. The endpoint deserializes the cookie contents via Marshal.load, triggering the embedded gadget chain and executing attacker-supplied Ruby code within the OpenProject process.

Refer to the OpenProject GitHub Security Advisory for further technical detail.

Detection Methods for CVE-2026-46386

Indicators of Compromise

Presence of SECRET_KEY_BASE=OVERWRITE_ME in container environment variables or process environment.
Unexpected _openproject_session or Rails session cookies containing large or malformed Base64 payloads sent to /my/two_factor_devices.
New child processes spawned by the OpenProject Ruby worker, particularly shells (sh, bash) or network utilities (curl, wget, nc).

Detection Strategies

Inspect running containers for the default secret by executing docker exec <container> printenv SECRET_KEY_BASE and flag any host returning OVERWRITE_ME.
Alert on HTTP requests to /my/two_factor_devices that carry oversized session cookies or produce ArgumentError or TypeError exceptions in Rails logs.
Correlate web server access logs with process execution telemetry to identify command execution originating from the Rails worker process.

Monitoring Recommendations

Monitor OpenProject application logs for repeated Marshal deserialization errors, which indicate probing attempts.
Track outbound network connections initiated by the OpenProject container to detect post-exploitation callbacks.
Baseline expected child processes of the Rails worker and alert on deviations such as interactive shells or scripting interpreters.

How to Mitigate CVE-2026-46386

Immediate Actions Required

Set a unique, high-entropy SECRET_KEY_BASE for every OpenProject deployment and restart the container to load it.
Upgrade to the fixed OpenProject release referenced in the GitHub Security Advisory GHSA-r85r-gjq2-f83r.
Invalidate all existing sessions after rotating the secret to void any cookies forged with the default key.

Patch Information

The maintainers have released a fixed version of OpenProject that removes the default SECRET_KEY_BASE value and moves cookie serialization away from the unsafe Marshal serializer. Consult the OpenProject Security Advisory for exact fixed versions and upgrade instructions.

Workarounds

Override SECRET_KEY_BASE with a cryptographically random value generated via openssl rand -hex 64 before starting the container.
Restrict network access to /my/two_factor_devices and other authenticated routes to trusted networks until patched.
Change the Rails cookies serializer to :json where supported to eliminate the Marshal deserialization path.

bash

# Configuration example: generate and set a strong SECRET_KEY_BASE
export SECRET_KEY_BASE=$(openssl rand -hex 64)

docker run -d \
  -e SECRET_KEY_BASE="$SECRET_KEY_BASE" \
  -p 8080:80 \
  openproject/openproject:latest