External risk intelligence

OpenHands Software Agent SDK Unauthenticated Sandbox Agent Server RCE

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-112346

The vulnerability affects a software agent SDK that, by default, binds a management and execution server to all network interfaces (0.0.0.0) without authentication. This configuration makes the service directly reachable over a network, and while it is often used in development contexts, the binding to all interfaces commonly exposes such services to broader network access if not explicitly restricted.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the OpenHands Software Agent SDK that could allow unauthenticated remote code execution. The issue stems from how workspace launchers, by default, bind the agent server to all network interfaces without requiring authentication. This could enable attackers to execute arbitrary commands with root privileges, access mounted workspaces, and read sensitive information if they can reach the exposed container port.

Unauthenticated remote code execution risk.
Default configuration bypasses critical security.
Confirm relevance to protect sensitive data.

Attack Path

How an attacker could exploit the issue

An attacker who can reach the published container port of the OpenHands Software Agent SDK can send unauthenticated requests to execute arbitrary commands. This could occur if the agent's sandbox environment is exposed externally, allowing network access to the vulnerable component. The vulnerability can lead to attackers gaining root-level control within the sandbox, accessing sensitive data, and potentially executing commands on the host system.

Exposed container port is reachable.
Unauthenticated HTTP/WebSocket requests trigger.
Arbitrary command execution as root.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to execute arbitrary commands with root privileges within a sandbox environment. This could lead to the exposure of sensitive information, such as secrets stored in a secrets store, and compromise the integrity of the workspace.

Root command execution in sandboxes.
Unauthenticated HTTP/WebSocket requests.
Exposure of plaintext secrets.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpenHands Software Agent SDK's remote code execution vulnerability primarily impacts platform or infrastructure teams responsible for managing development environments and CI/CD pipelines. The immediate first step is to determine the scope of exposure by identifying all instances of the affected SDK, confirming network reachability to these instances, and assessing their criticality to business operations. This information will inform the accountable owner and guide remediation planning based on risk.

Platform or infrastructure teams own this.
Verify network exposure and asset criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the OpenHands Software Agent SDK?

OpenHands is a toolkit designed to build AI-powered agents capable of software engineering tasks. The SDK provides specific workspace launchers, such as DockerWorkspace and Apptainer, which manage the isolated sandboxes where these AI agents perform their work, run code, and handle project files.

What does CWE-1327 mean for this vulnerability?

CWE-1327 identifies a weakness where an application fails to properly authenticate requests. In CVE-2026-112346, the sandbox agent server incorrectly initializes with an empty list of API keys. This means the server lacks the gatekeeping mechanism required to verify who is sending commands, effectively leaving the system open to anyone who can connect to it.

How is this vulnerability triggered?

The flaw is triggered when the agent server binds to all network interfaces, essentially listening for connections from anywhere rather than just the local machine. Simply having the service running is not enough to trigger the issue if the network is isolated; an attacker must be able to send HTTP or WebSocket requests directly to the container's published port.

Why is this considered a reachable risk?

According to Halo Surface Signal, this software often binds its management interface to all available network paths by default. Because these services are frequently used in development or CI/CD pipelines, they are often placed in environments where, if misconfigured, they become accessible to broader internal or external networks instead of remaining local.

What should I do if I run this SDK?

Start by auditing your infrastructure to locate all instances of the OpenHands SDK version 1.51.0 or earlier. Verify whether the container ports are reachable over your network and prioritize restricting access to these interfaces. Plan to update to version 1.52.0 or higher, which addresses the default configuration that allows these unauthenticated connections.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.