{"id":"CVE-2026-112346","kind":"vulnerability","aliases":["CVE-2026-112346"],"related":[],"title":"OpenHands Agent SDK: unauthenticated remote code execution via exposed sandbox server","description":"OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.","summary":"The OpenHands Software Agent SDK before 1.52.0 starts its DockerWorkspace and Apptainer sandbox agent server on all network interfaces with authentication disabled by default. An attacker who can reach the published container port can run arbitrary shell commands as root in the sandbox, read the mounted workspace, and read plaintext secrets.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","apptainer","docker","openhands","python"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed SDK version with `pip show openhands-sdk` or the lockfile; versions below `1.52.0` are affected.\n- Look for DockerWorkspace or Apptainer workspace launches in your code, and check whether `session_api_keys` is set to a non-empty list.\n- Check whether the published container port is reachable from outside the host with `docker ps` and a port scan from another machine.","fix":"- Upgrade the OpenHands Software Agent SDK to `1.52.0` or later.\n- Set a non-empty `session_api_keys` list on DockerWorkspace and Apptainer launchers until the upgrade is done.\n- Do not publish the sandbox container port to untrusted networks.","status":"open","published_at":"2026-10-26T16:17:14+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:32:43+00:00","updated_at":"2026-10-26T16:32:43+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-26T16:32:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the OpenHands Software Agent SDK to `1.52.0` or later.\n- Set a non-empty `session_api_keys` list on DockerWorkspace and Apptainer launchers until the upgrade is done.\n- Do not publish the sandbox container port to untrusted networks.","reach":"network","title":"OpenHands Agent SDK: unauthenticated remote code execution via exposed sandbox server","impact":"high","summary":"The OpenHands Software Agent SDK before 1.52.0 starts its DockerWorkspace and Apptainer sandbox agent server on all network interfaces with authentication disabled by default. An attacker who can reach the published container port can run arbitrary shell commands as root in the sandbox, read the mounted workspace, and read plaintext secrets.","category":"ai-tooling","nicknames":[],"who_cares":["openhands","python","docker","apptainer","ai-agents"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs root shell commands in the sandbox and reads secrets.","analyst_note":"Check the upstream OpenHands 1.52.0 release notes and advisory for exact affected package names and whether a non-empty session_api_keys default was added.","how_to_check":"- Check the installed SDK version with `pip show openhands-sdk` or the lockfile; versions below `1.52.0` are affected.\n- Look for DockerWorkspace or Apptainer workspace launches in your code, and check whether `session_api_keys` is set to a non-empty list.\n- Check whether the published container port is reachable from outside the host with `docker ps` and a port scan from another machine.","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Teams that run the OpenHands Software Agent SDK with the DockerWorkspace or Apptainer workspace launchers are exposed, especially where the published sandbox port is reachable from a network the attacker can access. Teams that do not use these launchers, or that set a session API key, are not affected by the default configuration described in the sources.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000714,"input_tokens":3410,"output_tokens":746,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112346':14A,17A '-2026':13A,16A '0.0.0.0':108C '1.52.0':34B,84C 'access':145C 'agent':2A,20B,31B,41B,81C,102C 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'api':113C 'apptain':24B,39B,96C 'arbitrari':63B,137C 'attack':53B,120C 'authent':48B,117C 'bind':99C 'code':6A,89C 'command':65B,139C 'contain':59B,85C,126C 'cve':12A,15A 'default':51B,119C 'disabl':49B,116C 'docker':25B 'dockerworkspac':37B,94C 'empti':111C 'execut':7A,90C,136C 'expos':9A 'http':131C 'interfac':46B,107C 'key':114C 'launcher':98C 'list':115C 'mount':73B,147C 'network':45B,106C 'openhand':1A,26B,29B,79C 'plaintext':77B,151C 'port':60B,127C 'publish':58B,125C 'python':27B 'reach':56B,123C 'read':71B,76B,150C 'remot':5A,88C 'request':134C 'root':67B,141C 'run':62B 'sandbox':10A,40B,70B,101C,144C 'sdk':3A,32B,82C 'secret':78B,152C,155C 'send':129C 'server':11A,42B,103C 'session':112C 'shell':64B,138C 'softwar':30B,80C 'start':35B 'store':156C 'tool':23B 'unauthent':4A,87C,130C 'via':8A 'vulner':91C 'websocket':133C 'workspac':74B,97C,148C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the OpenHands Software Agent SDK with the DockerWorkspace or Apptainer workspace launchers are exposed, especially where the published sandbox port is reachable from a network the attacker can access. Teams that do not use these launchers, or that set a session API key, are not affected by the default configuration described in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112346","severity":null,"published_at":"2026-10-26T16:17:14+00:00","modified_at":"2026-10-26T16:17:14+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}