> CVE-2026-46386 [CRITICAL]

« BACK_TO_HOME
PUBLISHED
2026-06-26 20:17
MODIFIED
2026-06-26 20:20
CVSS_SCORE V3
9.9
EPSS (Prob. Exploit)
0.49%
Top 57.8%
DATA SOURCES:
NVD 🔗 2026-06-26 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 OSV 🔗 2026-11-02

> DESCRIPTION

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fixed in .

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EXPLOITABILITY
3.1
IMPACT
6.0

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Network (N)
Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque)
Attack Complexity
Low (L)
Peu de conditions requises pour exploiter
PR (Privilèges Requis)
Privileges Required
Low (L)
Authentifié avec compte utilisateur basique
UI (Interaction Utilisateur)
User Interaction
None (N)
Aucune interaction utilisateur nécessaire
S (Périmètre)
Scope
Changed (C)
Impact s'étend au-delà du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
High (H)
Divulgation totale d'informations
I (Impact Intégrité)
Integrity Impact
High (H)
Modification totale des données possible
A (Impact Disponibilité)
Availability Impact
High (H)
Interruption totale du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité
High
Divulgation totale d'informations
Intégrité
High
Modification totale des données possible
Disponibilité
High
Interruption totale du service possible

> WEAKNESSES

CWE-502 CWE-798 CWE-1188 CWE-1392

> CWE DETAILED DESCRIPTIONS

CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. | CWE-798: Use of Hard-coded Credentials - The product contains hard-coded credentials, such as a password or cryptographic key. | CWE-1188: Initialization of a Resource with an Insecure Default - The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. | CWE-1392: Use of Default Credentials - The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

AFFECTED PACKAGES:
Unknown / Unknown
20 versions affected
ALIASES:
GHSA-r85r-gjq2-f83r

> HISTORIQUE DES MODIFICATIONS

Première apparition
26/06/2026 20:17
Source: NVD
📊 ENRICHISSEMENT 01/07/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. | CWE-798: Use of Hard-coded Credentials - The...
Total des modifications: 1 Dernière mise à jour: 4 months ago

> REFERENCES

https://github.com/opf/openproject/security/advisories/GHSA-r85r-gjq2-f83r
« BACK_TO_HOME