OpenHands Software Agent SDK: Unauthenticated remote code execution in sandbox

Summary

The OpenHands Software Agent SDK before 1.52.0 has an authentication bypass in its DockerWorkspace and Apptainer workspace launchers. The sandbox agent server binds to all network interfaces with no session API key set, so authentication is disabled by default. An attacker who can reach the published container port can send unauthenticated HTTP and WebSocket requests to run arbitrary shell commands as root in the sandbox, read the mounted workspace and access plaintext secrets.

Affected

• OpenHands Software Agent SDK from 0 to before 1.52.0
• Deployments using DockerWorkspace or Apptainer workspace launchers

Fixed in

• Upgrade to OpenHands Software Agent SDK 1.52.0 or later
• The fix publishes Docker ports on loopback (PR #5209). The Apptainer fix is unverified.

Workaround

• Do not publish the agent server port on all interfaces; bind published ports to 127.0.0.1
• Set a non-empty session API key for the agent server and confirm it is in effect at runtime
• Restrict network access to the container port with firewall rules
• Review container logs for requests that do not match your own agent sessions

Exploitation

• No known exploitation in the wild, according to the sources reviewed.
• No public proof of concept confirmed; one aggregator reports no KEV listing, which needs re-checking.
• Exploitation requires no authentication and network reachability to the published container port.

Our recommendation

• Check whether any host runs DockerWorkspace or Apptainer workspace launchers with reachable container ports.
• Upgrade to 1.52.0 or later and verify the Apptainer fix separately before relying on it.
• Set and verify a session API key, and restrict network access to the agent server.
• If a sandbox was exposed, rotate any secrets it could have read.
• Monitor container logs for unexpected HTTP or WebSocket requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Fix commit 7b66584 github.com
• Pull request #5209 github.com
• Release v1.52.0 github.com
• OpenCVE CVE-2026-112346 app.opencve.io
• Ostorlab analysis blog.ostorlab.co

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:41.