🚨 CRITICAL - OpenProject Docker image default SECRET_KEY_BASE enables Rails cookie deserialization (CVE-2026-46386) OpenProject’s official Docker image shipped with a default SECRET_KEY_BASE, impacting the OpenProject Rails app cookie handling path (notably the /my/two_factor_devices cookie reader). The root cause is insecure deserialization via Ruby on Rails cookies using Marshal serialization combined with a deterministic, known secret (improper secret management + unsafe deserialization). An authenticated attacker can exploit this by crafting a signed cookie that the app will accept and then triggering Marshal deserialization when hitting the affected endpoint. If exploited, this can lead to remote code execution in the application context and full compromise of the OpenProject instance and its data. 👉 Affected: openproject/openproject (official Docker image versions shipping with default SECRET_KEY_BASE; exact range TBD) | Upgrade to vendor-fixed release and rotate SECRET_KEY_BASE (fix version not specified)
Post summary
The OpenProject Docker image contains a default SECRET_KEY_BASE that enables insecure Ruby on Rails cookie deserialization, potentially allowing authenticated attackers to achieve remote code execution; a vendor‑fixed release is recommended.