CVE-2026-46386 is a critical vulnerability in OpenProject caused by deserialization of untrusted data. The official Docker image prior to an unspecified fixed version uses a default Rails master key (SECRET_KEY_BASE=OVERWRITE_ME) and sets cookies_serializer to :marshal. This combination enables any logged-in user to reach a deterministic Marshal deserialization path through the /my/two_factor_devices cookie, leading to potential remote code execution or other severe impacts. The vulnerability is fixed in a version not detailed in the provided information.

The vulnerability allows an attacker with logged-in user privileges to exploit unsafe deserialization via the /my/two_factor_devices cookie, potentially leading to full compromise of confidentiality, integrity, and availability of the OpenProject instance. The CVSS score of 9.9 reflects critical impact with network attack vector, low attack complexity, no user interaction, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix version or patch link is provided, users should monitor the vendor's announcements and update OpenProject Docker images once a fixed version is released. Avoid using the default SECRET_KEY_BASE value and consider changing cookies_serializer from :marshal to a safer option if possible.