Zero Radar
← feed
CriticalVulnerabilityCVE-2026-112346updated 26 Oct 2026, 16:21 UTC

OpenHands agent SDK lets outsiders run commands without a password

The OpenHands tool runs a helper server that anyone on the network can reach without logging in. An outsider who can reach it can run commands as root and read stored secrets.

Fix availableOfficial source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesUpgrade to OpenHands Software Agent SDK 1.52.0 or later · since 26 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker scans networkFinds the exposed sandbox port
  2. 2Connects without loginNo API key is required
  3. 3Sends shell commandsOver HTTP or WebSocket requests
  4. 4Runs as rootArbitrary commands in the sandbox
  5. 5Reads secretsPlaintext secrets store is accessible
  6. ResultAttacker controls the sandbox as root

What happened

OpenHands Software Agent SDK before 1.52.0 binds the sandbox agent server to 0.0.0.0 with an empty session_api_keys list in the DockerWorkspace and Apptainer workspace launchers, disabling authentication by default. Unauthenticated HTTP and WebSocket requests can execute arbitrary shell commands as root.

Why it is dangerous: An attacker who can reach the published container port can run commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

Are you affected?

You are affected if you run OpenHands Software Agent SDK before 1.52.0 with DockerWorkspace or Apptainer workspace launchers and the sandbox port is reachable from a network you do not fully control.

OpenHands Software Agent SDK before 1.52.0 (DockerWorkspace and Apptainer workspace launchers)

What to do

  1. Update OpenHands Software Agent SDK to 1.52.0 or later
  2. Until updated, block external access to the sandbox container port with a firewall
  3. Rotate any secrets that were stored in the sandbox workspace

Timeline

  1. 26 Oct 2026, 16:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 16:17 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 16:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-112346
CVSS
9.3 / 10
EPSS
1.0% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 16:17 UTC
On Zero Radar
26 Oct 2026, 16:21 UTC (5 min after disclosure)
Last change
26 Oct 2026, 16:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

OpenHands agent SDK lets outsiders run commands without a password · Zero Radar