CVE-2026-112346: OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-26
Weakness: CWE-1327

Description

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

Summary

OpenHands Software Agent SDK before 1.52.0 exposes its sandbox agent server on all interfaces (0.0.0.0) with an empty session_api_keys list, so authentication is disabled by default. Anyone who can reach the published container port can send unauthenticated HTTP and WebSocket requests to run arbitrary shell commands as root, access the mounted workspace, and read plaintext secrets. CVSS is 9.8 (critical); it is not in CISA KEV and no exploitation is reported. Upgrade to 1.52.0, and until then restrict network access to the sandbox port and set session_api_keys.

تسمح إصدارات OpenHands Software Agent SDK الأقدم من 1.52.0 لخادم وكيل البيئة المعزولة (sandbox agent server) بالاستماع على جميع واجهات الشبكة (0.0.0.0) مع قائمة session_api_keys فارغة، ما يعطّل المصادقة افتراضياً. يستطيع أي مهاجم يصل إلى منفذ الحاوية المنشور إرسال طلبات HTTP وWebSocket غير مصادَق عليها لتنفيذ أوامر shell عشوائية بصلاحيات root، والوصول إلى مساحة العمل المركّبة، وقراءة الأسرار النصية الصريحة من مخزن الأسرار. درجة CVSS هي 9.8 (حرجة)، ولا توجد معلومات عن استغلال فعلي، وهي غير مدرجة في CISA KEV. يجب الترقية إلى 1.52.0، وإلى حين ذلك تقييد الوصول الشبكي إلى منفذ البيئة المعزولة وضبط session_api_keys.

Affected products

OpenHands Software Agent SDK: before 1.52.0 — fixed in 1.52.0

How to fix

Upgrade to a fixed version: OpenHands Software Agent SDK 1.52.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-112346 or the next vulnerability affects your stack