CVE Intelligence
Analysis AI-assisted

CVE-2026-52780: OpenProject: cache poisoning leading to remote code execution

OpenProject, an open-source web-based project management tool, is affected by cache store poisoning that can lead to remote code execution, according to the GitHub advisory. The record fixes the issue in versions 17.3.3 and 17.4.1 and rates it critical with CVSS 3.1 base score 9.6. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

OpenProject is open-source, web-based project management software. According to the GitHub Security Advisory, versions prior to 17.3.3 and 17.4.1 are affected by cache store poisoning that leads to remote code execution (RCE). The record associates the issue with CWE-20, Improper Input Validation.

Impact

  • The record rates the issue as critical, with CVSS 3.1 base score 9.6.
  • The vector indicates network attack vector, low complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity and availability.
  • The advisory describes the outcome as remote code execution.

Affected products and versions

  • Product: OpenProject.
  • Affected: versions prior to 17.3.3 and 17.4.1.
  • Fixed: 17.3.3 and 17.4.1.
  • The structured affected and fixes lists in the record are empty, so the complete version matrix should be confirmed in the advisory.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The record includes an EPSS probability of 0.0039 (percentile 0.3128) dated 2026-10-13.

Remediation and mitigation

  • Upgrade OpenProject to 17.3.3 or 17.4.1, according to the release line in use.
  • Review the GitHub advisory for vendor guidance on upgrade steps and configuration.
  • Until the upgrade is applied, limit network exposure of the instance and restrict access to trusted users.

Detection guidance

  • Review application and web server logs for unusual requests or errors related to cache handling.
  • Monitor the application host for unexpected processes or file changes.
  • Confirm the installed version after the upgrade.

Limitations of the available information

  • The record does not describe the technical mechanism of the cache poisoning.
  • Affected version ranges beyond the two stated branches are not listed in the structured data.
  • Whether specific configurations are required for exploitation is unknown from the record.
  • The record has no title, so the title here is derived from the description.

Frequently asked questions

Which OpenProject versions are fixed for CVE-2026-52780?

According to the record, the issue is fixed in versions 17.3.3 and 17.4.1. The record states that versions prior to these are affected.

Is CVE-2026-52780 known to be exploited in the wild?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Monitoring and prompt patching are still advisable.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.