al-ice.ai

Bound to Every Interface, Keyed to Nothing: OpenHands Agent SDK’s Unauthenticated Sandbox RCE

AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 26 October 2026 CVE-2026-112346 was published for OpenHands Software Agent SDK: a CVSS 9.8 unauthenticated remote code execution flaw (CWE-1327, binding to an unrestricted IP address) affecting all versions before 1.52.0 and fixed in 1.52.0. The DockerWorkspace and Apptainer workspace launchers bound the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Anyone who could reach the published container port could send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store. The VulnCheck advisory credits the finder as mil4n.

The vector is maximally permissive — AV:N / AC:L / PR:N / UI:N / S:U with full confidentiality, integrity, and availability impact — and the mechanism is a two-line trust failure compounding into one: a wildcard bind plus an empty allowlist. Either half alone would be a hardening finding; together they mean the sandbox’s command channel had no gate at all, and the prize behind it was root plus the workspace mount plus the secrets store in the clear. The fix, PR #5209 (“publish Docker ports on loopback”), landed 3 October and shipped in v1.52.0 (released 5 October, per the GitHub release timestamp) — roughly three weeks before the 26 October disclosure. Anyone tracking current releases was therefore protected before the CVE existed; this advisory is a catch-up notice for deployments pinned below 1.52.0, and the Singapore CSA’s 28 October security bulletin independently lists the same CVE, which corroborates the disclosure timeline.

Why defenders should take this seriously — and where to discount it

The serious part is the venue: OpenHands is a widely used coding-agent SDK, and its sandbox server is exactly the component that holds shell access, source trees, and credentials by design — an unauthenticated path to it is an agent-infrastructure skeleton key. This is the same missing-auth pattern we keep finding in agent tooling this month, from NVIDIA’s NeMo Agent Toolkit 10.0 to the MCP Python SDK’s bearer-auth audience bypass. The discount: exploitation requires network reachability to the published container port, so sandboxes behind loopback-only networking or a firewall were never exposed; no in-the-wild exploitation is claimed by any source we read; and NVD still lists the record as Awaiting Analysis. Patch-pinned and internet-adjacent Docker hosts running pre-1.52.0 workspaces are the population that should move first.

What it means for builders and defenders

  • Upgrade OpenHands Software Agent SDK to 1.52.0 or later. The fix binds published workspace ports to loopback and is covered by new regression tests; there is no workaround documented.
  • Treat every agent sandbox port as hostile until bound to loopback. Audit docker port mappings and Apptainer networking for 0.0.0.0-published agent servers, especially on shared dev hosts and CI runners.
  • Rotate secrets that lived in pre-1.52.0 sandbox stores. The secrets store was readable in plaintext to anyone who reached the port — assume exposure for any network-reachable instance and rotate.
  • Enforce non-empty session API keys as a deploy gate. An empty key list silently disabling auth is a fail-open default; assert at startup that authentication material is present.

Our verification was read-only. The NVD record for CVE-2026-112346 was read first-hand in full (published 26 October 2026, Awaiting Analysis), including the description, CVSS 3.1 vector and score, and all four references; the VulnCheck advisory was read first-hand (dated 26 October 2026, CVSS v4 9.3, CWE-1327, credit mil4n); the fix commit 7b66584 and PR #5209 were read first-hand via the GitHub API (message, date, and changed files); and the v1.52.0 release record was read first-hand (published 5 October 2026). The Singapore CSA 28 October bulletin was used only as corroboration of the disclosure. No software was installed, no container was run, no network target was contacted, no exploit was obtained or run, and no vendor or researcher was contacted. Brave Search was used for discovery only.

Sources: