OpenHands Software Agent SDK before 1.52.0: Docker and Apptainer sandboxes published the agent server on every interface with no API key, CVE-2026-112346 (9.3)

View raw markdownEdit on GitHub ↗

TL;DR

VulnCheck published CVE-2026-112346 on 2026-10-26 (CVSS 4.0 9.3, 3.1 9.8, finder mil4n): the OpenHands Software Agent SDK's DockerWorkspace and Apptainer launchers started the sandbox agent server bound to 0.0.0.0 with an empty session_api_keys list, so authentication was off by default and anyone who could reach the published container port could run shell commands as root inside the sandbox, read the mounted workspace and read plaintext secrets. The fix, pull request #5209 "publish Docker ports on loopback" (commit 7b66584, merged 2026-10-03), shipped in v1.52.0 on 2026-10-05; the repository has no published GitHub security advisory, so the CVE record is the only vendor-adjacent notice. Upgrade and check what the port was reachable from.

What happened

The CVE record (VulnCheck CNA, published 2026-10-26 15:34 UTC) describes an unauthenticated remote code execution in pkg:github/OpenHands/software-agent-sdk for every version before 1.52.0: the two container launchers bind the agent server to all interfaces and pass an empty API-key list, which disables authentication. An attacker reaching the port runs arbitrary commands as root in the sandbox, has the mounted workspace, and can read the secrets the SDK passes into the sandbox in plaintext. References are the v1.52.0 release tag, PR #5209, the patch commit and VulnCheck's advisory. The sandbox is the component meant to contain the agent; this bug turned it into an open shell on whatever network the Docker host faced.

Registry, read 2026-10-26: pip index versions openhands-sdk returned no version list in this session, so the fixed version here is the record's 1.52.0 and the release tag, not a registry check.

Why it is here: OpenHands is one of the frameworks this corpus files most often (git diff RCE, GuardFall), the SDK is what teams embed to run coding agents in CI and on shared dev boxes, and "sandbox port published on every interface with auth off" is the default-exposure class behind the Lasso and VulnCheck agent-platform waves.

Am I affected?

  • pip show openhands-sdk or the SDK's lockfile pin: anything below 1.52.0 with DockerWorkspace or the Apptainer workspace in use.
  • docker ps on the host: the agent-server container's port mapping shows 0.0.0.0:<port> rather than 127.0.0.1:<port> on affected versions.
  • If the host had a routable address or sat on a shared network, treat the sandbox, its workspace and every secret passed to it as exposed for the time the container ran.

If you are affected

  1. Upgrade to 1.52.0 or later and confirm the mapping now binds to loopback.
  2. Rotate the API keys and tokens the sandbox was given (provider keys, GitHub tokens, cloud credentials): if your local AI agent was exploited, then rotating cloud credentials.
  3. Review the workspace for commits or files you did not create during the exposure window.

Prevention

  • Agent sandboxing: publish agent ports on loopback only, put a key on every agent server, and keep the Docker host off untrusted networks.
  • MCP hygiene: the same loopback-plus-auth rule for every local server an agent talks to.

Sources