CVE-2026-46386: OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

Synopsis

A remote code execution vulnerability exists in the official OpenProject Docker image due to a hardcoded default Rails secret key (`SECRET_KEY_BASE=OVERWRITE_ME`) combined with a Marshal-based cookie serializer. Any authenticated user can craft a malicious serialized cookie that the server deserializes without verification, because the secret used to sign cookies is publicly known. Successful exploitation gives the attacker full code execution on the server. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable cookie-deserialization endpoint is exposed over the network, so the attacker must be able to reach the OpenProject service via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker only needs a valid session to submit a crafted cookie to the vulnerable endpoint.

• Victim interactionNot required

  No victim action is required; the attacker submits the malicious cookie directly and the server processes it immediately.

• Attack complexityDetail

  Exploit complexity is low: the secret key is a known, hardcoded default, so constructing a valid malicious Marshal payload requires no race conditions or environmental guesswork.

Blast Radius

• The attacker executes arbitrary operating-system commands as the Rails application process user inside the container.
• All data accessible to the application, including project records, user credentials, and stored secrets, can be read.
• The attacker can modify or delete any data the application can write, including project content and user accounts.
• The running container can be crashed or repurposed as a pivot point into other services on the same internal network.