Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-112346OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE

Critical 9.8

In plain English

A critical-severity security flaw in OpenHands Software Agent SDK from OpenHands. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.0%top 36.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

Affected products (as reported)

Vendor	Product	Versions
OpenHands	OpenHands Software Agent SDK	0 – before 1.52.0

Weakness: CWE-1327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Fixed Release Tag release-notes
Pull Request issue-tracking
Patch Commit patch
VulnCheck Advisory: OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE third-party-advisory