CVE-2026-112346

OpenHands workspace exposure enables unauthenticated sandbox command execution

OpenHands · Software Agent SDK workspaces

First documented disclosure · Review checkpoint

Summary

Reachable unauthenticated agent-server ports expose sandbox commands, workspace files and secrets.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Reviewed sources do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Launchers bind broadly; empty session_api_keys disables authentication.

Conditions required

Network access to the published agent-server port with authentication disabled.

Potential impact

Root command execution inside the sandbox; host escape is not established.

Affected versions and configurations

Before 1.52.0, according to VulnCheck.

Fix and mitigation status

CNA identifies 1.52.0; its linked patch restricts Docker host-port publication and propagates configured keys.

Practical next steps

Upgrade and verify effective authentication and host-side bindings. Check Apptainer separately: the cited Docker patch explicitly excludes it.

Operating lesson

A sandbox command API still needs an authenticated, restricted network boundary.

Evidence and limits

The public fix PR opened September 21, merged October 3 and shipped October 5; CNA publication followed October 26. CNA scope includes Apptainer, but the linked implementation explicitly changes only DockerWorkspace. Container-side 0.0.0.0 remains necessary for forwarding; do not confuse it with host-port exposure.

Sources