CVE-2026-46386: OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV…

PriorityP263critical9.9CVSS 3.1

AVNACLPRLUINSCCHIHAH

EPSS

0.27%

18.9th percentile

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fixed in .

Affected

2 ranges

Vendor	Product	Version range	Fixed in
opf	openproject	—	—
opf	openproject	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.