CVE-2026-46386

CVSS 9.9 · CRITICAL
EPSS p19
Lower risk — in the top 81% least-likely-to-be-exploited CVEs.
No patch reference
No patch/mitigation in references

Published 6/26/2026 · updated 6/26/2026 · CWE-502, CWE-798, CWE-1188, CWE-1392

Share
Get asset-aware triage

Summary

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fixed in .

CVSS 9.9CRITICAL

9.9 / 10
  • AV: Network
  • AC: Low complexity
  • PR: Low privileges
  • UI: No user interaction
  • S: Scope changed
  • C: Confidentiality: High
  • I: Integrity: High
  • A: Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS exploitation probability

0.3%

Percentile p19 Lower risk — in the top 81% least-likely-to-be-exploited CVEs.

Timeline

  1. Jun 26, 2026 · Disclosed / published in NVD
  2. Jun 26, 2026 · Intel last updated

Intel sources

Which upstream feeds returned data for this CVE, and when they were last fetched.

  • NVD· 36 days ago
  • CVE.org· no data
  • FIRST EPSS· 36 days ago
  • CISA KEV· no data
  • OSV· 36 days ago

References

Unlock the full report

See how CVE-2026-46386 hits your stack.

Free public data ends here. Sign in to correlate this CVE against your SBOM and assets, get an AI-grounded exploit chain, generate a ModSecurity virtual patch, and share findings with your team.

  • · Asset-aware CVSS & priority
  • · Grounded AI analysis (A–D graded)
  • · Auto-generated WAF / IPS rules
  • · Jira, SIEM, Slack, Teams delivery

No credit card · 100 free enrichments · analyst-grade citations.