CVE-2026-52780: OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)

Synopsis

A cache store poisoning vulnerability in OpenProject allows an unauthenticated attacker on the same network segment to inject malicious data into the application's cache layer, which the server then deserializes or executes, resulting in full remote code execution. The attacker requires no credentials and no victim interaction; adjacent network access such as a shared LAN, cloud subnet, or VPN is sufficient to reach the cache backend. Successful exploitation gives the attacker arbitrary code execution in the context of the OpenProject server process. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream publishes a fixed release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network segment, such as a shared LAN, cloud VPC subnet, or VPN, to reach the cache backend; direct internet exposure is not required but internal network adjacency is.

• AuthenticationNot required

  No credentials of any kind are needed; the attacker can target the cache store without authenticating to the OpenProject application.

• Victim interactionNot required

  Exploitation is fully server-side; no user needs to click a link, open a file, or take any action for the attack to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker executes arbitrary operating system commands in the context of the OpenProject server process, giving them full control of the application runtime.
• All data the OpenProject instance can access, including project records, user credentials, attachments, and API tokens, is readable by the attacker.
• The attacker can modify or delete any data stored or accessible by OpenProject, including project plans, issue trackers, and user account records.
• The attacker can crash or indefinitely disrupt the OpenProject service, making it unavailable to all users on the instance.