CVE-2026-46386: OpenProject Docker Image Default Secret Key Base Enables Deserialization Risk
CVE-2026-46386 affects the official openproject/openproject Docker image, which according to the record ships a default placeholder value for the Rails secret key base. Combined with Marshal cookie serialization, the record describes a path that lets any logged-in user reach unsafe deserialization. The CNA rates it 9.9 (CVSS 3.1, critical), but the record lacks affected and fixed version data.
Overview
OpenProject is open-source, web-based project management software. According to the CVE record, the official openproject/openproject Docker image ships with a default placeholder value for the Rails secret key base. The application is also configured to serialize cookies with Marshal, and the record states that this combination gives any logged-in user a deterministic deserialization path through a cookie reader on a user-facing route.
The weakness is classified as CWE-502, Deserialization of Untrusted Data. The original advisory is available at GitHub Security Advisory GHSA-r85r-gjq2-f83r.
Impact
The CNA scored the issue 9.9 under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact to confidentiality, integrity and availability, as reported by the CNA.
In practical terms, an attacker who can log in to the application is described as able to reach unsafe deserialization. The record does not describe the resulting effects in more detail.
Affected products and versions
The record lists no affected version ranges and no fixed versions. The description text has missing version values in both the affected and fixed statements, so the exact impacted releases cannot be determined from the sources consulted. Administrators should confirm their deployed image tag and version against the vendor advisory.
Exploitation status
The CISA KEV catalog does not list this CVE in the record provided. No confirmed exploitation appears in the sources consulted. EPSS is 0.0049 with a percentile of 0.40451 as recorded.
Remediation and mitigation
- Identify every deployment that uses the official openproject Docker image or a derived image, and check whether the secret key base was left at a default or placeholder value.
- Replace any default secret key base with a unique, high-entropy value supplied through a secrets manager or protected environment configuration.
- Plan an upgrade to a release that the vendor identifies as fixed in the GitHub advisory. The record does not state the fixed version.
- Rotating the secret key base will normally invalidate existing sessions and signed data; schedule this with users in mind.
- Limit who can create accounts on the instance and review existing accounts, since the record describes the risk as applying to logged-in users.
Detection guidance
- Audit container environment variables and orchestration manifests for the default placeholder secret value.
- Review application and reverse proxy logs for unusual cookie sizes or repeated failed deserialization or server error events at a high level.
- Compare running image digests and tags against the vendor's published release information once the fixed version is confirmed.
Limitations of the available information
The source record has no English title, no affected or fixed version data, and contains blank version placeholders in its description. The CVSS score and vector come from the CNA rather than from a confirmed NVD analysis within this record. The advisory linked in the record is the only vendor-side reference used here, and its contents beyond the record were not reviewed.
Frequently asked questions
What is CVE-2026-46386?
It is a critical deserialization weakness in the official OpenProject Docker image, which according to the record ships a default Rails secret key base. The CNA scored it 9.9 under CVSS 3.1.
Is this vulnerability being actively exploited?
The CVE is not listed in the CISA KEV catalog in the record provided, and no confirmed exploitation appears in the sources consulted.
Which versions are affected and what is the fix?
The record does not list affected or fixed versions, and its description has missing version values. Check the GitHub advisory and your image tag to confirm your exposure and the vendor-provided fix.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.