Executive Summary

CVE-2026-46386 is a critical vulnerability in the official openproject/openproject Docker image that allows remote code execution. It occurs because the Docker image ships with a default hardcoded environment variable SECRET_KEY_BASE=OVERWRITE_ME and uses Rails cookie serialization with the Marshal format. This combination enables attackers to craft malicious cookies that, when deserialized, execute arbitrary Ruby code inside the container.

The vulnerability affects versions from 8.3.0 through 17.3.1, including certain branches, unless the SECRET_KEY_BASE is manually changed. Attackers can exploit this flaw either before authentication (if self-registration is enabled) or after logging in with any low-privilege account.

Exploitation results in admin-level control over OpenProject or the ability to execute OS commands within the container, potentially compromising sensitive data and network resources. The root causes include hardcoded credentials, insecure default initialization, and unsafe deserialization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including complete compromise of the OpenProject instance running inside the Docker container. An attacker can gain administrative privileges or execute arbitrary operating system commands within the container.

Such control allows unauthorized access to sensitive project management data, manipulation or deletion of information, and potential lateral movement within the network. It also threatens the confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the OpenProject Docker container is running with the default hardcoded environment variable SECRET_KEY_BASE=OVERWRITE_ME.

You can inspect the environment variables of the running container to verify if SECRET_KEY_BASE is set to the insecure default.

• Run the command: docker exec <container_id_or_name> printenv SECRET_KEY_BASE
• Alternatively, inspect the Docker image or container configuration for the environment variable with: docker inspect <container_id_or_name> | grep SECRET_KEY_BASE

If the output shows SECRET_KEY_BASE=OVERWRITE_ME, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include explicitly setting a secure and unique SECRET_KEY_BASE environment variable for the OpenProject Docker container.

Ensure that the application does not use the default insecure value 'OVERWRITE_ME' for SECRET_KEY_BASE.

Update the OpenProject Docker image to a fixed version where the vulnerability is addressed.

Verify that the cookie serialization method is switched from Marshal to JSON to prevent unsafe deserialization.

If the application fails to start after setting SECRET_KEY_BASE, reconfigure accordingly as the fix aborts startup if the variable is unset or insecure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to execute arbitrary code with admin-level privileges or OS command execution within the container, potentially leading to unauthorized access to sensitive data or network resources.

Such unauthorized access and control can compromise the confidentiality, integrity, and availability of data managed by OpenProject, which may include personal or sensitive information.

Therefore, exploitation of this vulnerability could result in non-compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls to protect sensitive data from unauthorized access and breaches.

Useful 0 Not Useful 0