All vulnerabilities
CVE-2026-112346

OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE

OpenHands OpenHands Software Agent SDK
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.52.0Fixed versionCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 1.52.0OpenHands Software Agent SDKCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 2

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

Text from CVE List

Affected versions 1

  • OpenHands Software Agent SDKaffected: all versions before 1.52.0CVE List

References 4