---
id: "CVE-2026-122236"
kind: "vulnerability"
aliases: ["CVE-2026-122236"]
title: "OpenHands: landing page lacks authentication, exposing local-network access"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-coding-agent", "ai-tooling", "local-network", "openhands", "self-hosted"]
not_affected_if: ["no-local-network-access", "version-1.25.0-or-later"]
published_at: "2026-11-05T04:17:12+00:00"
first_seen_at: "2026-11-05T04:31:48+00:00"
updated_at: "2026-11-05T04:33:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122236", "first_seen_at": "2026-11-05T04:31:48+00:00"}]
exploit_sources: []
---

# OpenHands: landing page lacks authentication, exposing local-network access

OpenHands, an AI coding agent platform, has a missing authentication check in its Landing Page component in versions up to 1.24.0. A attacker on the same local network can reach functionality that should require login.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenHands version and confirm whether it is `1.24.0` or earlier.
- Look for OpenHands instances reachable from the local network without a login prompt.

## Fix

- Upgrade OpenHands to `1.25.0`.

## Timeline

- 2026-11-05T04:31:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122236

## Documents

- [fix] Patch: github.com https://github.com/OpenHands/OpenHands/commit/c5efa3ae415def0a903c82d2b17b748e663b1995
- [fix] Release notes: github.com https://github.com/OpenHands/OpenHands/releases/tag/v1.25.0

## From the sources

A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_