---
id: CVE-2026-112346
title: OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
summary: >-
  OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote
  code execution vulnerability where the DockerWorkspace and Apptainer workspace
  launchers bind the sandbox agent server to all network interfaces (0.0.0.0)
  with…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1327
vendor: OpenHands
product: OpenHands Software Agent SDK
affected:
  - software_agent_sdk < 1.52.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T15:34:30.749Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112346'
references:
  - url: 'https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.52.0'
    label: Fixed Release Tag
  - url: 'https://github.com/OpenHands/software-agent-sdk/pull/5209'
    label: Pull Request
  - url: >-
      https://github.com/OpenHands/software-agent-sdk/commit/7b66584ff8899144eb4ce679c2811861342af9de
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/openhands-software-agent-sdk-unauthenticated-sandbox-agent-server-rce
    label: >-
      VulnCheck Advisory: OpenHands Software Agent SDK < 1.52.0 Unauthenticated
      Sandbox Agent Server RCE
tags:
  - cve.org
ingestedAt: '2026-10-26T16:31:40.070Z'
---

## Overview

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

## Affected

- `software_agent_sdk < 1.52.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.