Advisory · CVE-2026-112346
Unauthenticated OpenHands sandbox agent server allows remote code execution
OpenHands Software Agent SDK before 1.52.0 binds the sandbox agent server to all network interfaces with authentication disabled by default, so anyone who can reach the published container port can execute shell commands as root in the sandbox. CVSS 3.1 9.8.
- Vendor
- OpenHands
- Product
- Software Agent SDK
- Identifier / CWE
- CVE-2026-112346
CWE-1327 - Action timing
- Immediate
Explain it like I’m five
The sandbox that is supposed to keep the AI agent boxed in leaves its control door open to the whole network with no key required. Anyone who can reach the door can walk in and run commands inside the box, where the code and stored secrets live.
- 01Sandbox starts exposed
The DockerWorkspace or Apptainer launcher binds the sandbox agent server to all network interfaces (0.0.0.0) and publishes the container port.
- 02No authentication by default
The session API key list is empty by default, so the agent server accepts requests without authentication.
- 03Attacker sends commands
An attacker who can reach the port sends unauthenticated HTTP or WebSocket requests to the agent server.
- 04Root shell in the sandbox
The requests execute arbitrary shell commands as root in the sandbox, with access to the mounted workspace.
- 05Secrets are read
The attacker can read plaintext secrets from the sandbox secrets store and any files in the mounted workspace.
What happened
NVD published CVE-2026-112346 on October 26, 2026, rating it critical at CVSS 3.1 9.8 (CVSS 4.0 9.3). The entry states that OpenHands Software Agent SDK versions before 1.52.0 are affected: the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, which disables authentication by default.
Anyone who can reach the published container port can send unauthenticated HTTP and WebSocket requests and execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store, according to the NVD entry. The 1.52.0 release changelog includes a workspace fix described as publishing Docker ports on loopback, and NVD lists 1.52.0 as the first unaffected version.
What to do
- Inventory deployments of the OpenHands Software Agent SDK that use the DockerWorkspace or Apptainer launchers, including developer, CI, and shared team sandboxes.
- Upgrade affected installations to version 1.52.0 or later.
- Until every instance is upgraded, restrict who can reach published sandbox container ports: bind to loopback where possible and apply network controls so untrusted networks cannot reach the agent server.
- Determine whether any sandbox port was reachable from an untrusted network while running an affected version, and review agent server, container, and network logs for unauthenticated requests from unknown sources.
- Rotate secrets that were present in the secrets store or the mounted workspace of any sandbox whose port may have been reachable, and review workspace files for unexpected changes.
- After upgrading, verify the agent server is no longer bound to all interfaces without authentication.
Management note
A sandbox is a trust boundary, and this default configuration turned it into an unauthenticated network service holding code and plaintext secrets. Treat any internet or shared-network reachability as an exposure to investigate, not just a version to bump, and make loopback binding plus authentication the expected posture for agent sandboxes generally.