CVE-2026-46386 is a critical vulnerability in OpenProject where the official Docker image ships with a default Rails master key (SECRET_KEY_BASE=OVERWRITE_ME) combined with cookies serialized using Marshal. This setup enables any authenticated user to exploit a deterministic Marshal deserialization path accessible through the /my/two_factor_devices cookie. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and related CWEs. Although the description mentions the vulnerability is fixed in a certain version, no explicit version or patch details are provided in the input data.

The vulnerability allows an authenticated user to perform unsafe deserialization, potentially leading to full compromise of confidentiality, integrity, and availability of the OpenProject instance. The CVSS score of 9.9 reflects critical impact with network attack vector, low attack complexity, and no user interaction required beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch details are provided, users should monitor the vendor's announcements for updates. Until a fix is available, avoid using the default Docker image with the fixed SECRET_KEY_BASE and consider disabling or changing the cookies_serializer setting from :marshal if possible.