CVE-2026-112346 OpenHands CVE debrief

Who should care

Defenders responsible for OpenHands Software Agent SDK deployments, especially those with publicly exposed ports, should assess their exposure and prioritize upgrading to version 1.52.0 or later.

Why it matters

CVE-2026-112346 is a critical vulnerability in OpenHands Software Agent SDK that allows unauthenticated remote code execution. Defenders should prioritize verifying exposure, upgrading to version 1.52.0 or later, restricting access to the sandbox agent server, and monitoring for suspicious activity.

• Verify exposure of OpenHands Software Agent SDK instances
• Upgrade to version 1.52.0 or later to prevent exploitation
• Restrict access to the sandbox agent server to prevent unauthorized access
• Monitor for suspicious activity to detect potential exploitation

Technical summary

The OpenHands Software Agent SDK before version 1.52.0 contains an unauthenticated remote code execution vulnerability. The vulnerability is caused by the DockerWorkspace and Apptainer workspace launchers binding the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, effectively disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

Defensive priority

Defenders should prioritize verifying exposure of OpenHands Software Agent SDK instances, especially those with publicly exposed ports, and upgrade to version 1.52.0 or later.

Recommended defensive actions

• Verify exposure of OpenHands Software Agent SDK instances, especially those with publicly exposed ports
• Upgrade to version 1.52.0 or later
• Restrict access to the sandbox agent server
• Monitor for suspicious activity
• Perform vulnerability scanning to identify potential exposure
• Review and update incident response plans to address potential exploitation
• Implement additional logging and monitoring to detect suspicious activity

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. However, there is limited information on potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.