The OpenHands Software Agent SDK before 1.52.0 binds its sandbox agent server to every network interface and turns authentication off by default. As a result, anyone who can reach the exposed port can run commands as root inside the sandbox.
What Is It
CVE-2026-112346 is an unauthenticated remote code execution vulnerability in the OpenHands Software Agent SDK. The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0). They also start it with an empty session_api_keys list, which turns off authentication by default.
VulnCheck reported the issue and classifies it as CWE-1327 (Binding to an Unrestricted IP Address). NVD published the record on 2026-10-26, and its status is currently "Awaiting Analysis."
Why It Matters
An attacker who can reach the published container port can send unauthenticated HTTP and WebSocket requests to:
- execute arbitrary shell commands as root inside the sandbox
- access the mounted workspace
- read plaintext secrets from the secrets store
VulnCheck rates the flaw CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CVSS 4.0 9.3 (Critical). The attack works over the network, has low complexity, and needs no privileges or user interaction.
This CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data contains no confirmation of active exploitation.
What's Vulnerable
- Vendor: OpenHands
- Product: OpenHands Software Agent SDK (
pkg:github/OpenHands/software-agent-sdk) - Affected versions: all versions before 1.52.0
- Affected components: the DockerWorkspace and Apptainer workspace launchers
Exposure depends on whether an attacker's network position can reach the sandbox's published container port.
Patch Status
A fix is available in OpenHands Software Agent SDK v1.52.0. The vendor references a fix commit (7b66584) and pull request #5209.
Required action: upgrade to version 1.52.0 or later. Until you upgrade, treat any sandbox container port reachable from untrusted networks as exposed. Also treat secrets held in the sandbox secrets store as potentially compromised. Because no CISA KEV entry exists, there is no federal remediation deadline.