OpenHands Software Agent SDK CVE-2026-112346

Exploitation requires that the deployment use the DockerWorkspace or Apptainer workspace launcher in its default configuration, where the sandbox agent server is bound to all interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication. The attacker must additionally be able to reach the published container port over the network. Limiting factors: only these two launcher types are affected; deployments that override the default to set session API keys, bind to loopback, or restrict the published port via host firewalling/network segmentation are not exposed. No user interaction or credentials are required against an affected default install. The fix (v1.52.0) publishes Docker ports on loopback rather than all interfaces.

This is a genuine high-priority issue, and the signals are mutually reinforcing rather than conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity and availability impact on the vulnerable system - fully consistent with the description of an insecure-default (CWE-1327, binding to 0.0.0.0 with authentication disabled). The vuln.today decision label is act_now and a vendor patch (v1.52.0) is available, so remediation is urgent and actionable. Tempering the raw score: this is an insecure default rather than a memory-corruption bug, so exploitation is trivial but conditional on the affected workspace launchers being used and the container port being reachable. No EPSS score was provided, the CVE is not listed in CISA KEV, and no confirmed public exploit code is present in the input - so despite act_now priority there is no evidence of active exploitation; the urgency rests on exploitation ease, VulnCheck's advisory, and full technical impact, not on observed in-the-wild activity.

An attacker on the same network as (or with routable access to) a host running OpenHands Software Agent SDK before 1.52.0 with a DockerWorkspace or Apptainer sandbox discovers the published agent-server port, which is bound to 0.0.0.0 with no session API key. They send unauthenticated HTTP/WebSocket requests to run arbitrary shell commands as root inside the sandbox, read the mounted workspace, and exfiltrate plaintext secrets from the secrets store. No public exploit identified at time of analysis, but exploitation is trivial given the missing authentication.