CVE-2026-52824: Kimai Docker Image Hardcoded APP_SECRET Enables Account Takeover

Key facts for Kimai default APP_SECRET

Detection coverage for Kimai default APP_SECRET

As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1556 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Kimai Container Running With Default Hardcoded APP_SECRET (CVE-2026-52824)

Detects Docker/container inventory or environment-inspection telemetry showing a Kimai container running with the publicly documented placeholder APP_SECRET=change_this_to_something_unique, confirming the instance is exploitable for remember-me cookie, LoginLink, and CSRF token forgery.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1552.001, T1588
• Data sources: docker_inspect_logs, cmdb_container_inventory
• Severity: critical
• Confidence: high

Splunk SPL

index=containers sourcetype="docker:inspect" OR sourcetype="cmdb:container_env"
  (image="*kimai*" OR container_name="*kimai*")
  env="APP_SECRET=change_this_to_something_unique"
| eval risk="CVE-2026-52824: hardcoded APP_SECRET exposed"
| table _time, host, container_name, image, env, risk
| sort -_time

Microsoft KQL

ContainerInventory
| where TimeGenerated > ago(24h)
| where Image has "kimai"
| where EnvironmentVariables has "APP_SECRET=change_this_to_something_unique"
| project TimeGenerated, Computer, ContainerName, Image, EnvironmentVariables
| extend Risk = "CVE-2026-52824: hardcoded APP_SECRET exposed"

Sigma

title: Kimai Default APP_SECRET Container Environment Exposure
id: 8f3e1c2a-1b4a-4e7c-9f21-cb1556aa0001
status: experimental
description: Detects a Kimai Docker container running with the publicly documented hardcoded default APP_SECRET (CVE-2026-52824), which enables cookie/LoginLink/CSRF forgery.
references:
    - https://github.com/kimai/kimai/security/advisories/GHSA-jr9p-4h4j-6c58
    - https://advisories.gitlab.com/composer/kimai/kimai/CVE-2026-52824/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-20
tags:
    - cve.2026.52824
    - attack.credential_access
    - attack.t1552.001
logsource:
    category: container_inspect
    product: docker
detection:
    selection:
        Image|contains: 'kimai'
        EnvironmentVariables|contains: 'APP_SECRET=change_this_to_something_unique'
    condition: selection
falsepositives:
    - Non-production/sandbox Kimai instances intentionally left on defaults with no network exposure
level: high

Known false positives:

• Isolated lab/sandbox Kimai containers with no network reachability that were never intended to be production-hardened

Tuning notes: Restrict scope to container inventory/CSPM sources that actually capture environment variables (avoid scanning secrets in cleartext logs beyond this narrow detection); extend the string match to catch partial/obfuscated variants of the placeholder if operators only masked part of it.

• 🔒 Kimai Public-Facing Exploit Attempt — Unauthenticated Forged Token Submission · unlock with TL Creds
• 🔒 Kimai Privileged Session Creation Without Corresponding Interactive Login Event · unlock with TL Creds
• 🔒 Kimai Password-Reset Link Reused After Account Password Change (GHSA-m492-gv72-xvxj) · unlock with TL Creds
• 🔒 X-AUTH-USER/X-AUTH-TOKEN Timing-Based Username Enumeration Preceding Token Forgery (GHSA-jrc6-fmhw-fpq2) · unlock with TL Creds
• 🔒 Kimai LoginLink/Password-Reset Requests Enumerating Sequential Numeric User IDs (Sigma) · unlock with TL Creds
• 🔒 Kimai Post-Fix APP_SECRET File Tampering or Unauthorized Read (Persistence/Lateral Movement) · unlock with TL Creds
• 🔒 Kimai LoginLink/Password-Reset Enumeration of Low Sequential User IDs · unlock with TL Creds
• 🔒 Kimai [indicator] Cookie Authentication From Previously Unseen Source Without Password Login · unlock with TL Creds

Indicators of compromise for Kimai default APP_SECRET

As of 2026-07-20, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-1556.

How Kimai default APP_SECRET works

CVE-2026-52824 is an insecure-default (CWE-1188) vulnerability in the official kimai/kimai Docker image. Kimai is a PHP/Symfony open-source time-tracking application. The Docker image's Dockerfile and entrypoint.sh set APP_SECRET to the literal placeholder string "change_this_to_something_unique" and, prior to the fix, never enforced that operators override it before the application became reachable. APP_SECRET backs Symfony's kernel.secret, which is the cryptographic key used to sign and verify several security-critical, HMAC-protected tokens throughout the application: the KIMAI_REMEMBER remember-me cookie, LoginLink signed URLs (used for password reset and one-time login links), and CSRF tokens.

Because the default value is publicly documented in Kimai's own Docker Hub instructions, changelogs, and countless public docker-compose.yml examples, it functions as a de facto master key shared across every Kimai Docker deployment that was never explicitly reconfigured. An unauthenticated attacker who reaches a vulnerable instance over the network and knows (or discovers, e.g. via the related username-enumeration timing side channel GHSA-jrc6-fmhw-fpq2) a target's username and numeric user ID can independently compute valid HMAC signatures for that user's remember-me cookie or LoginLink, granting a fully authenticated session without ever supplying a password. Because Kimai assigns user IDs as small sequential integers, the platform's own super_admin account is trivially guessable, making full administrative takeover the realistic worst case. A companion advisory, GHSA-m492-gv72-xvxj (CWE-640, Weak Password Recovery Mechanism), compounds the impact: the LoginLink/password-reset signature historically covered only the user ID and not the current password hash, so a forged reset link remains valid even after the victim changes their password, and low signature entropy made the links themselves easier to guess independent of secret exposure.

The vulnerability was reported by security researcher AzureADTrent and coordinated with Kimai maintainer Kevin Papst. A working proof-of-concept demonstrating cookie/LoginLink forgery was initially published alongside the advisory and later withdrawn by the researcher to limit misuse, which the vendor and downstream reporting both treat as confirmation of practical exploitability rather than a theoretical weakness. The fix, shipped in Kimai 2.58.0, rewrites the Docker entrypoint to remove the hardcoded default entirely: if no APP_SECRET is supplied, the entrypoint now generates a cryptographically random 32-byte secret via bin2hex(random_bytes(32)), persists it to /opt/kimai/var/data/.appsecret so it survives container restarts, and writes it into /opt/kimai/.env.local. The fix also increases LoginLink signature entropy per GHSA-m492-gv72-xvxj. Any pre-2.58.0 Docker deployment that never set a custom APP_SECRET remains fully exploitable until upgraded or reconfigured, and instances that were exposed while vulnerable should be treated as potentially compromised: secrets must be rotated, all active sessions invalidated, and administrator account activity audited, since simply upgrading does not retroactively invalidate tokens forged with the old, known secret.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts

Privilege Escalation

T1078 Valid Accounts

Defense Evasion

T1078 Valid Accounts

Discovery

T1087 Account Discovery

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1606 Forge Web Credentials

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1592 Gather Victim Host Information; T1595 Active Scanning

Remediation for Kimai default APP_SECRET

Patches

• Kimai 2.58.0 — entrypoint.sh no longer ships a hardcoded APP_SECRET default; generates and persists a random 32-byte secret via bin2hex(random_bytes(32)) when none is supplied

Immediate actions

• Upgrade all Kimai Docker deployments to version 2.58.0 or later
• If upgrading is not immediately possible, explicitly set a unique, high-entropy APP_SECRET environment variable rather than relying on the image default
• Treat any instance that ran with the default APP_SECRET as potentially compromised: rotate the secret and invalidate all active sessions
• Force-expire and reissue all KIMAI_REMEMBER cookies, LoginLink tokens, and CSRF tokens after secret rotation
• Audit administrator (super_admin) account activity and password-reset history for signs of unauthorized access

Workarounds

• Manually set a unique, randomly generated APP_SECRET environment variable in the container/deployment configuration before exposing the instance to any network

Longer-term hardening

• Enable two-factor authentication for all privileged (super_admin) accounts, since 2FA blocks token-forgery-based takeover even if APP_SECRET is exposed
• Restrict network exposure of Kimai instances that do not need to be internet-facing
• Adopt secrets-management tooling (e.g. Docker secrets, a vault) instead of plaintext environment variables for APP_SECRET
• Periodically audit self-hosted container images for hardcoded default credentials or secrets before production deployment
• Apply the related GHSA-m492-gv72-xvxj and GHSA-jrc6-fmhw-fpq2 fixes to close the password-reset-validity and username-enumeration issues that compound this flaw

Affected and fixed versions

• Kimai — Kimai (Docker image, kimai/kimai)
  Vulnerable versions: <= 2.57.0; all versions using the official Docker image without a custom APP_SECRET
  Fixed in: 2.58.0

Timeline of Kimai default APP_SECRET

• 2026-06-11 Vulnerability privately disclosed to and acknowledged by locked-ioc-13 maintainer locked-ioc-12 for coordinated remediation.
• 2026-06-11 Security researcher locked-ioc-10 discovers and reports the hardcoded locked-ioc-13 Docker image APP_SECRET issue to maintainer locked-ioc-12.
• 2026-07-14 Companion advisories GHSA-m492-gv72-xvxj (password-reset link remains valid after password change) and GHSA-jrc6-fmhw-fpq2 (username enumeration via X-AUTH-USER timing side channel) are published alongside CVE-2026-52824, documenting flaws that compound its exploitability by supplying the username precondition and extending forged-link validity.
• 2026-07-14 GitHub Security Advisory GHSA-jr9p-4h4j-6c58 is published by the locked-ioc-11 repository, formally documenting the flaw and fix.
• 2026-07-14 locked-ioc-13 2.58.0 ships, removing the hardcoded APP_SECRET default and adding random secret generation (bin2hex(random_bytes(32))) with persistent storage.
• 2026-07-14 GitLab Advisory Database publishes the formal CVE-2026-52824 record with CVSS 3.1 vector and affected/fixed version ranges.
• 2026-07-20 GBHackers publishes an independent technical analysis of the vulnerability, corroborating exploitation mechanics and remediation guidance.
• 2026-07-20 Cyber Security News publishes the first mainstream write-up of CVE-2026-52824, noting a proof-of-concept was released and later withdrawn to limit misuse.

Sources cited for Kimai default APP_SECRET

• CVE-2026-52824: Kimai Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover GitLab · Advisory · 2026-07-14
• GHSA-jr9p-4h4j-6c58: Kimai Docker default APP_SECRET GitHub · Advisory · 2026-07-14
• GHSA-m492-gv72-xvxj: Kimai Password Reset Link Remains Valid After Password Change GitLab · Advisory
• GHSA-jrc6-fmhw-fpq2: Kimai Username Enumeration via Timing on X-AUTH-USER GitLab · Advisory
• Kimai Official Security Advisory: GHSA-jr9p-4h4j-6c58 kimai.org · Vendor report
• NVD entry for CVE-2026-52824 (reserved, pending publication) NVD (NIST) · Research
• Cyber Security News: Kimai Docker Vulnerability cybersecuritynews.com · News · 2026-07-20
• Kimai Docker Vulnerability Exposes Default APP_SECRET, Enabling Account Takeover gbhackers.com · News · 2026-07-20

Threats related to Kimai default APP_SECRET

• WordPress Kirki Plugin CVE-2026-8206 — Unauthenticated Account Takeover via Password-Reset Email Hijack (Active Exploitation, ~500K Sites)
• SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) — Unauthenticated Forged-Token Technician Account Creation and MFA Bypass