CVE-2026-112346: OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty sessionapikeys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenHands Software Agent SDKto a version that resolves this vulnerability.Fixed in 1.52.0
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments using the DockerWorkspace or Apptainer workspace launchers are exposed if the sandbox agent server's published container port is reachable by an attacker. The vulnerable configuration binds the service to all network interfaces and disables authentication.
What access does an attacker need to exploit this issue?
An attacker does not need credentials or user interaction. They need network reachability to the published container port, after which they can use unauthenticated HTTP or WebSocket requests.
What can an attacker do after exploiting the sandbox agent server?
An attacker can execute arbitrary shell commands as root in the sandbox. They can also access the mounted workspace and read plaintext secrets from the secrets store.
What version addresses the vulnerable default behavior?
Upgrade OpenHands Software Agent SDK to version 1.52.0 or later. Versions before 1.52.0 are affected.