Openhands Software Agent Sdk
Monthly
Unauthenticated remote code execution affects OpenHands Software Agent SDK releases before 1.52.0 when the DockerWorkspace or Apptainer workspace launchers are used in their default configuration: the sandbox agent server binds to 0.0.0.0 with an empty session_api_keys list, so authentication is effectively disabled. A remote attacker who can reach the published container port (CVSS 4.0 base 9.3, assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact) can issue unauthenticated HTTP and WebSocket requests to run arbitrary shell commands as root inside the sandbox, read the mounted workspace, and pull plaintext secrets from the secrets store. Vendor patch v1.52.0 is available and the priority decision is act_now; no public exploit code was identified in the supplied data, though VulnCheck reported the issue.
Unauthenticated remote code execution affects OpenHands Software Agent SDK releases before 1.52.0 when the DockerWorkspace or Apptainer workspace launchers are used in their default configuration: the sandbox agent server binds to 0.0.0.0 with an empty session_api_keys list, so authentication is effectively disabled. A remote attacker who can reach the published container port (CVSS 4.0 base 9.3, assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact) can issue unauthenticated HTTP and WebSocket requests to run arbitrary shell commands as root inside the sandbox, read the mounted workspace, and pull plaintext secrets from the secrets store. Vendor patch v1.52.0 is available and the priority decision is act_now; no public exploit code was identified in the supplied data, though VulnCheck reported the issue.