CVE-2026-112346

Summary

The OpenHands Software Agent SDK before 1.52.0 exposes its sandbox agent server on all network interfaces with no authentication by default, allowing unauthenticated remote code execution as root via HTTP/WebSocket requests.

Exploitability

Exploitation is trivial for any attacker with network access to the exposed container port; no authentication or user interaction is required.

Blast radius

Successful exploitation grants full root access inside the sandbox, enabling compromise of the agent’s workspace, exfiltration of plaintext secrets, and potential lateral movement if the sandbox environment is misconfigured.

Detection

Look for unauthenticated HTTP or WebSocket requests to the agent server endpoint (e.g., /api/ or /ws/) from external IP addresses, especially those containing shell command patterns in request bodies or query parameters; also monitor for unexpected outbound connections from the sandbox container to unknown external hosts.

Prioritized remediation

Upgrade to OpenHands Software Agent SDK version 1.52.0 or later, which fixes the default binding and authentication misconfiguration.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.