---
id: "CVE-2026-112346"
kind: "vulnerability"
aliases: ["CVE-2026-112346"]
title: "OpenHands Agent SDK: unauthenticated remote code execution via exposed sandbox server"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "apptainer", "docker", "openhands", "python"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-26T16:17:14+00:00"
first_seen_at: "2026-10-26T16:31:01+00:00"
updated_at: "2026-10-26T16:32:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112346", "first_seen_at": "2026-10-26T16:31:01+00:00"}]
---

# OpenHands Agent SDK: unauthenticated remote code execution via exposed sandbox server

The OpenHands Software Agent SDK before 1.52.0 starts its DockerWorkspace and Apptainer sandbox agent server on all network interfaces with authentication disabled by default. An attacker who can reach the published container port can run arbitrary shell commands as root in the sandbox, read the mounted workspace, and read plaintext secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SDK version with `pip show openhands-sdk` or the lockfile; versions below `1.52.0` are affected.
- Look for DockerWorkspace or Apptainer workspace launches in your code, and check whether `session_api_keys` is set to a non-empty list.
- Check whether the published container port is reachable from outside the host with `docker ps` and a port scan from another machine.

## Fix

- Upgrade the OpenHands Software Agent SDK to `1.52.0` or later.
- Set a non-empty `session_api_keys` list on DockerWorkspace and Apptainer launchers until the upgrade is done.
- Do not publish the sandbox container port to untrusted networks.

## Timeline

- 2026-10-26T16:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112346

## From the sources

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_