A critical vulnerability, CVE-2026-46386, has been identified in OpenProject, an open-source web-based project management platform. The vulnerability stems from the default configuration of the official openproject/openproject Docker image, which sets the ENV SECRET_KEY_BASE=OVERWRITE_ME as the Rails master key. When combined with the cookies_serializer = :marshal setting, this configuration enables a logged-in user to exploit a deterministic Marshal-deserialization path through the /my/two_factor_devices cookie reader. This allows an attacker to execute arbitrary code on the server, leading to potential system compromise. The risk level is critical, with a CVSS score of 9.9, as exploitation requires minimal user interaction and can be triggered remotely. All instances of OpenProject using the affected Docker image versions are at risk. Organizations should immediately apply the latest security patches provided by the OpenProject team to mitigate this vulnerability. Users are advised to review their deployment configurations, ensure the SECRET_KEY_BASE is properly overwritten, and disable the Marshal serializer if not required. Failure to address this issue promptly could result in unauthorized access, data breaches, or complete system takeover.