CVE-2026-46386

Name of the Vulnerable Software and Affected Versions OpenProject (affected versions not specified)

Description The official openproject/openproject Docker image uses a default Rails master key SECRET KEY BASE=OVERWRITE ME. When combined with the cookies serializer = :marshal configuration, this allows any authenticated user to trigger a deterministic Marshal-deserialization path. This process occurs through the cookie reader at the '/my/two factor devices' endpoint. Marshal-deserialization is a process where data is converted from a byte stream back into an object, which can be exploited if the input is untrusted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.