Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-46386: OpenProject Docker Image Exposes Master Key

CVE-2026-46386

Summary

OpenProject's Docker image exposes a sensitive key, which can be used by attackers to access user sessions. This is a security concern because it could allow unauthorized access to project management data. To fix this, update to the latest version of the OpenProject Docker image.

Original title

Original description

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fixed in .

nvd CVSS3.1 9.9

Vulnerability type

CWE-502 Deserialization of Untrusted Data

CWE-798 Use of Hard-coded Credentials

CWE-1188

CWE-1392

https://github.com/opf/openproject/security/advisories/GHSA-r85r-gjq2-f83r

Published: 26 Jun 2026 · Updated: 20 Jul 2026 · First seen: 26 Jun 2026