# OpenHands Agent SDK: the sandbox server listened on every interface

> CVE-2026-112346 let anyone who could reach an OpenHands sandbox port run commands as root and read its stored secrets.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-26
- **CVE:** CVE-2026-112346
- **CVSS:** 9.3
- **Affects:** OpenHands Software Agent SDK, OpenHands
- **Research by:** mil4n, VulnCheck
- **Primary source:** https://www.vulncheck.com/advisories/openhands-software-agent-sdk-unauthenticated-sandbox-agent-server-rce
- **Page:** https://theinjection.dev/items/openhands-agent-sdk-sandbox-server-unauth-rce/

OpenHands Software Agent SDK before 1.52.0 published its sandbox agent server on every host interface with authentication turned off, VulnCheck reports, so anyone who could reach the port ran commands as root in the sandbox.

## What happened

VulnCheck published an advisory for CVE-2026-112346 on 26 October 2026, and the GitHub Advisory Database and NVD listed the same flaw that day. VulnCheck credits mil4n for reporting it in the OpenHands Software Agent SDK. OpenHands had already shipped the fix in version 1.52.0 three weeks earlier.

## How it works

The DockerWorkspace and Apptainer workspace launchers published the sandbox agent server's container ports on every host interface, and started the server with an empty session_api_keys list, which turns authentication off. A reachable port therefore accepted unauthenticated HTTP and WebSocket requests. VulnCheck reports that those requests run shell commands as root inside the sandbox, reach the mounted workspace, and read the secrets store in plain text. GitHub classes the flaw as CWE-1327, binding to an unrestricted IP address.

## Who is affected

Releases of the OpenHands Software Agent SDK below 1.52.0 are affected when a workspace runs under the Docker or Apptainer launcher. Reachability decides real exposure, so hosts on shared or routable networks are the ones most at risk. Teams that updated the SDK since early October are already on a fixed release.

## What to do

Upgrade the OpenHands Software Agent SDK to 1.52.0 or later. Check whether any sandbox agent server answers on an address other than 127.0.0.1, and treat secrets held in an exposed workspace or secrets store as compromised.

## Quick facts

- **Affected:** OpenHands Software Agent SDK before 1.52.0, Docker and Apptainer workspaces
- **Fixed in:** 1.52.0
- **CVE:** CVE-2026-112346
- **Disclosed:** 26 October 2026, by VulnCheck
- **Status:** Fixed before disclosure: the loopback change merged on 3 October 2026
- **Attack type:** Unauthenticated remote code execution, CWE-1327
- **Found by:** mil4n, credited by VulnCheck

## Questions

### Is the OpenHands Agent SDK patched against CVE-2026-112346?

OpenHands shipped the fix in Software Agent SDK 1.52.0, and the change that publishes DockerWorkspace ports on loopback merged on 3 October 2026, three weeks before VulnCheck published the advisory. Anyone running 1.52.0 or later is on a fixed release. Releases below 1.52.0 stay exposed, and VulnCheck gives no workaround other than upgrading.

### How do I check whether my OpenHands sandbox was exposed?

Inspect the published port mappings of your OpenHands sandbox containers. On a fixed release the host side of the mapping starts with 127.0.0.1, covering the agent server port and the VS Code port next to it. A mapping without that loopback address, or a sandbox server that answers on a routable address, means the port was reachable from outside the host.

### What could an attacker reach through the OpenHands sandbox server?

VulnCheck names three outcomes for an attacker who could reach the port: shell commands running as root inside the sandbox, access to the mounted workspace, and plaintext reads from the secrets store. Requests needed no credentials, because the launchers started the server with an empty session key list. Treat every secret stored in an exposed workspace as compromised.

### Which OpenHands workspaces does the flaw affect?

VulnCheck names the DockerWorkspace and Apptainer workspace launchers as the components that bound the sandbox agent server to all interfaces. The fix for the Docker path moves the host mapping to 127.0.0.1 and passes the configured session key through to the workspace client. Deployments that never published a sandbox port to an untrusted network were harder to reach.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/openhands-software-agent-sdk-unauthenticated-sandbox-agent-server-rce)
2. [GitHub Advisory](https://github.com/advisories/GHSA-rp7h-crm7-h5qj)
3. [Fix Pull Request](https://github.com/OpenHands/software-agent-sdk/pull/5209)
4. [Release 1.52.0](https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.52.0)