OpenProject Docker Pre-Auth RCE via Default SECRET_KEY_BASE and Marshal Deserialization

Vulnerability Overview Vulnerability Name: Pre-authentication RCE in Docker image via default and Vulnerability Description: The official Docker image defaults to using as the Rails master key. Combined with , this provides any logged-in user with a deterministic Marshal deserialization path via the cookie reader, leading to the following issues: 1. Admin user insertion via + 2. OS command execution as the Puma worker process (uid 1000) via + , exploiting CVE-2026-43136 Vulnerability Impact: The hardcoded key was introduced in commit , has been present since v8.3.0, and continues to exist in v17.3.1, v17.4 releases, and dev builds. When an attacker knows the key used to generate internal keys, they can craft encrypted cookies that are decoded server-side using , allowing the attacker to execute nearly arbitrary Ruby code within the container, up to full remote code execution. This issue is particularly critical for Docker containers that default to using when not manually overridden. Scope of Impact Affected Versions: (Docker) version >8.3.0 Affected Deployments: Any deployment running the official Docker image, from v8.3.0 to v17.3.1, including release/17.4 and dev, where the environment variable is not overridden (190 stable distributions). Source installations where is not overridden are similarly affected, but the Docker image is the canonical distribution vector where the hardcoded key is utilized. Any downstream stack packaging or repackaging of the image without overriding the environment variable, specifically openDesk / ZenDAS (the German Federal Sovereign Workplace Reference Stack), which distributes OpenProject without overriding . Remediation Remediation Measures: As a fix, the Docker container now verifies whether the environment variable is set. If it is not set, the application aborts booting and displays an error message. Documentation has been updated to clarify that the environment variable must be set. Decoding of encrypted cookies has been updated to use JSON encoding instead of Object Marshalling. Administrators who do not set the environment variable must now set it; otherwise, the application will not start. This forces all users to log in using two-factor authentication for the next 14 days, even if they have saved cookies to skip 2FA. Fixed Versions: 17.2.4, 17.3.2, 17.4.0 POC Code or Exploit Code No specific POC code or exploit code was provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

OpenProject Docker Pre-Auth RCE via Default SECRET_KEY_BASE and Marshal Deserialization

More from this source