CVE-2026-112346
OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
- State
- Published
- Severity
- 9.3 Critical
- Published
- Oct 26, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 19, 2026
Description
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-1327 Binding to an Unrestricted IP Address
Affected Products
| Product | Versions |
|---|---|
OpenHands Software Agent SDKOpenHands |
|
References
- Fixed Release Tagrelease-notes
- Pull Requestissue-tracking
- Patch Commitpatch
- VulnCheck Advisory: OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCEthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.