Critical Kimai Docker Vulnerability Exposes Deployments to Account Takeover (CVE-2026-52824)
A critical vulnerability in Kimai’s official Docker image, tracked as CVE-2026-52824 (GHSA-jr9p-4h4j-6c58), has been disclosed, exposing installations to account takeover risks due to a publicly known default cryptographic secret. The flaw affects Kimai versions 2.57.0 and earlier and was patched in version 2.58.0, released following a report by security researcher AzureADTrent and publication by maintainer Kevin Papst on June 11.
Root Cause & Exploitation Risks
The vulnerability stems from an insecure default configuration in Kimai’s Docker image, where the environment variable APP_SECRET=change_this_to_something_unique intended to be replaced during deployment was never validated or enforced. This secret serves as the kernel.secret in Symfony, a cryptographic key used to sign security artifacts like remember-me cookies, CSRF tokens, password-reset URLs, and LoginLink signatures.
If left unchanged, attackers could exploit the predictable secret to forge authentication tokens and impersonate users, including super_admin accounts. Successful exploitation requires:
- Knowledge of the target username,
- The account ID (often sequential, e.g.,
11for the first admin), - A lack of two-factor authentication (2FA) on the target account.
User IDs may be exposed in URLs or API responses, further simplifying attacks.
Impact & Mitigation
The issue, classified as CWE-1188 ("Initialization of a Resource with an Insecure Default"), underscores a broader problem in container security: hardcoded secrets in production images without enforcement of secure initialization.
Kimai’s 2.58.0 patch addresses the flaw by:
- Automatically generating a random
APP_SECRET(bin2hex(random_bytes(32))) if none is provided, - Storing the secret in
/opt/kimai/var/data/.appsecretand writing it to/opt/kimai/.env.local, - Removing the insecure default from the Dockerfile and updating documentation to emphasize unique, deployment-specific secrets.
Additionally, Kimai increased entropy in LoginLink values (GHSA-m492-gv72-xvxj) to prevent attackers from generating valid links using the default secret though this is not a substitute for patching.
Recommended Actions
Affected organizations must:
- Upgrade to Kimai 2.58.0 or later,
- Explicitly set a strong, unique
APP_SECRET, - Rotate secrets on potentially compromised instances,
- Invalidate active sessions, review admin accounts, and enable 2FA,
- Restrict public access to Kimai instances where unnecessary.
Source: https://gbhackers.com/kimai-docker-vulnerability-exposes-default-app_secret/
Kimai cybersecurity rating report: https://www.rankiteo.com/company/kimai-org
"id": "KIM1784528630",
"linkid": "kimai-org",
"type": "Vulnerability",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users of Kimai Docker images '
'(versions 2.57.0 and earlier)',
'industry': 'Software Development, Productivity Tools',
'name': 'Kimai',
'type': 'Software (Time Tracking Application)'}],
'attack_vector': 'Default Cryptographic Secret',
'data_breach': {'personally_identifiable_information': 'Potential (if admin '
'accounts contain PII)',
'sensitivity_of_data': 'High (authentication artifacts, admin '
'account access)',
'type_of_data_compromised': 'Authentication tokens, CSRF '
'tokens, password-reset URLs, '
'LoginLink signatures'},
'date_publicly_disclosed': '2024-06-11',
'description': 'A critical vulnerability in Kimai’s official Docker image, '
'tracked as CVE-2026-52824 (GHSA-jr9p-4h4j-6c58), exposes '
'installations to account takeover risks due to a publicly '
'known default cryptographic secret. The flaw affects Kimai '
'versions 2.57.0 and earlier and was patched in version '
'2.58.0. The vulnerability stems from an insecure default '
'configuration where the environment variable '
'`APP_SECRET=change_this_to_something_unique` was never '
'validated or enforced, allowing attackers to forge '
'authentication tokens and impersonate users, including '
'super_admin accounts.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'insecure default configurations',
'data_compromised': 'Authentication tokens, CSRF tokens, '
'password-reset URLs, LoginLink signatures',
'identity_theft_risk': 'High (if PII or admin accounts are '
'compromised)',
'operational_impact': 'Account takeover, unauthorized access to '
'admin accounts',
'systems_affected': 'Kimai Docker deployments (versions 2.57.0 and '
'earlier)'},
'initial_access_broker': {'high_value_targets': 'Admin accounts (e.g., '
'super_admin)'},
'investigation_status': 'Patched',
'lessons_learned': 'Hardcoded secrets in production images pose significant '
'risks. Secure initialization of cryptographic secrets '
'must be enforced, and default configurations should not '
'be relied upon in production environments.',
'post_incident_analysis': {'corrective_actions': 'Automatic generation of a '
'random `APP_SECRET`, '
'removal of insecure default '
'from Dockerfile, updated '
'documentation, increased '
'entropy in LoginLink values',
'root_causes': 'Insecure default configuration in '
'Kimai’s Docker image (hardcoded '
'`APP_SECRET`), lack of validation '
'or enforcement for unique secrets'},
'recommendations': ['Upgrade to Kimai 2.58.0 or later',
'Explicitly set a strong, unique `APP_SECRET`',
'Rotate secrets on potentially compromised instances',
'Invalidate active sessions and review admin accounts',
'Enable two-factor authentication (2FA)',
'Restrict public access to Kimai instances where '
'unnecessary'],
'references': [{'source': 'GitHub Advisory',
'url': 'https://github.com/advisories/GHSA-jr9p-4h4j-6c58'},
{'source': 'Kimai Release Notes'}],
'response': {'containment_measures': 'Upgrade to Kimai 2.58.0 or later, '
'explicitly set a strong `APP_SECRET`, '
'rotate secrets on potentially '
'compromised instances',
'recovery_measures': 'Invalidate active sessions, review admin '
'accounts, enable 2FA, restrict public '
'access to Kimai instances',
'remediation_measures': 'Automatic generation of a random '
'`APP_SECRET`, removal of insecure '
'default from Dockerfile, updated '
'documentation'},
'title': 'Critical Kimai Docker Vulnerability Exposes Deployments to Account '
'Takeover (CVE-2026-52824)',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2026-52824 (GHSA-jr9p-4h4j-6c58), CWE-1188'}