Critical Flaw in Kimai Docker Image Exposes Admin Accounts to Takeover

A critical security vulnerability, identified as CVE-2026-52824 with a CVSS score of 9.1 (Critical), has been discovered in the official Docker image of Kimai, an open-source time-tracking application. The flaw allows an unauthenticated attacker to perform account takeover, including super-admin accounts, by forging signed cookies. This is possible because the affected Docker image shipped with a publicly known default `APP_SECRET`. The vulnerability impacts Kimai versions up to and including 2.57.0 and has been patched in version 2.58.0. While a proof-of-concept exists, no in-the-wild exploitation has been confirmed yet. This vulnerability is highly significant for any organization or individual utilizing the Kimai time-tracking application, particularly those deploying it via the official Docker image. The ability for an unauthenticated attacker to achieve account takeover, especially of super-admin accounts, means that sensitive business data, user information, and potentially critical operational controls are at severe risk. The ease of exploitation, stemming from a hardcoded default secret, makes this a low-barrier target for malicious actors. Given that Kimai is used by freelancers and companies with hundreds of users, the blast radius of this vulnerability could be substantial. Furthermore, the sequential nature of user IDs in Kimai means that targeting specific high-privilege accounts, like the super_admin (user ID 1), is straightforward. This incident serves as a stark reminder that even widely adopted open-source projects can harbor critical security flaws in their packaging and deployment mechanisms. The Kimai vulnerability exemplifies a recurring and well-established security challenge in the DevOps and containerization landscape: the danger of insecure defaults and secrets management. Despite widespread awareness and best practices advocating against hardcoded credentials and default secrets, such issues continue to emerge. This is not an isolated incident; previous Docker-related vulnerabilities, such as CVE-2026-34040 (an authorization bypass in Docker Engine due to oversized request bodies), and earlier issues like CVE-2024-41110 (a zero-length body bypass), highlight the continuous need for vigilance in container security. The proliferation of AI agents operating in Docker-based sandboxes, as noted in discussions around CVE-2026-34040, also introduces new vectors where such vulnerabilities could be exploited, potentially by autonomous agents seeking to bypass controls during debugging or other tasks. The industry has been moving towards more secure supply chain practices, including the use of Docker Hardened Images and tools like Docker Scout for vulnerability scanning, yet the responsibility often falls on the end-user to ensure their deployed applications adhere to these standards. For practitioners, the immediate action is to upgrade Kimai to version 2.58.0 without delay. This version addresses the vulnerability by generating a random `APP_SECRET` during setup, eliminating the hardcoded default. For those unable to upgrade immediately, it is imperative to manually set a unique, strong `APP_SECRET` and rotate it if the old default was ever in use. Additionally, enabling two-factor authentication (2FA) can provide an extra layer of defense against potential account takeovers. Beyond this specific fix, this incident should prompt a broader review of deployment practices for all containerized applications. Developers should scrutinize Dockerfiles and deployment configurations for any default secrets, weak credentials, or other insecure settings. Operations teams should implement automated scanning for known vulnerabilities in container images (e.g., using tools like Docker Scout) and enforce policies that prevent the deployment of images with critical flaws. Restricting network access to sensitive applications and APIs, and adopting rootless mode for Docker containers where possible, are also crucial mitigation strategies. The lesson here is clear: security is not a one-time configuration but a continuous process of auditing, updating, and hardening.