Live › vulnerability › CVE-2026-112346
Go to dashboardThe OpenHands Software Agent SDK before 1.52.0 starts its DockerWorkspace and Apptainer sandbox agent server on all network interfaces with authentication disabled by default. An attacker who can reach the published container port can run arbitrary shell commands as root in the sandbox, read the mounted workspace, and read plaintext secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Teams that run the OpenHands Software Agent SDK with the DockerWorkspace or Apptainer workspace launchers are exposed, especially where the published sandbox port is reachable from a network the attacker can access. Teams that do not use these launchers, or that set a session API key, are not affected by the default configuration described in the sources.
No product ranges from the sources yet.
pip show openhands-sdk or the lockfile; versions below 1.52.0 are affected.session_api_keys is set to a non-empty list.docker ps and a port scan from another machine.1.52.0 or later.session_api_keys list on DockerWorkspace and Apptainer launchers until the upgrade is done.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
This page as .md · .json · in your agent: get_signal("CVE-2026-112346")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.