---
title: OpenHands agent SDK before 1.52.0 published its sandbox agent server on every network interface with no API key, so anyone on the network could run root commands and read the agent's stored secrets (CVE-2026-112346, 9.8) | ctxsec
url: https://ctxsec.com/items/openhands-sdk-cve-2026-112346-unauth-sandbox-agent-server-rce
description: ""
status: "confirmed (CVE/GitHub advisory published Oct 26; fix in OpenHands SDK v1.52.0, Oct 5); no known exploitation"
published: 2026-10-27
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/openhands-sdk-cve-2026-112346-unauth-sandbox-agent-server-rce.md)

confirmed (CVE/GitHub advisory published Oct 26; fix in OpenHands SDK v1.52.0, Oct 5); no known exploitation

2026-10-27

### OpenHands agent SDK before 1.52.0 published its sandbox agent server on every network interface with no API key, so anyone on the network could run root commands and read the agent's stored secrets (CVE-2026-112346, 9.8)

The OpenHands Software Agent SDK runs coding agents inside a Docker or Apptainer sandbox, and an **agent server** inside that sandbox accepts commands over HTTP and WebSocket. Before **v1.52.0**, the DockerWorkspace and Apptainer launchers published that server on **0.0.0.0** with an empty `session_api_keys` list, which turns authentication off. Anyone who could reach the published port, on the same LAN, Wi-Fi or a cloud VM with open ports, could:

- run arbitrary shell commands as root in the sandbox,
- read and change the mounted workspace (your repo), and
- read the plaintext secrets store, typically model provider and Git tokens.

The fix (PR #5209, released in v1.52.0 on Oct 5) publishes Docker ports on 127.0.0.1 only and passes the session API key through to the client. The CVE and advisory (CVSS 9.8, CWE-1327) were published on Oct 26. **What to do:** upgrade the SDK, check running containers with `docker ps` for agent-server ports bound to 0.0.0.0, and rotate any tokens that were in an agent's secrets store on a machine reachable by others. The same check applies to any agent harness that starts a local control server.

Sources: [GitHub Advisory GHSA-rp7h-crm7-h5qj / CVE-2026-112346: OpenHands Software Agent SDK unauthenticated sandbox RCE](https://github.com/advisories/GHSA-rp7h-crm7-h5qj) · [OpenHands software-agent-sdk PR #5209: publish Docker ports on loopback](https://github.com/OpenHands/software-agent-sdk/pull/5209) · [OpenHands software-agent-sdk v1.52.0 release](https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.52.0) · [VulnCheck advisory: OpenHands SDK unauthenticated sandbox agent server RCE](https://www.vulncheck.com/advisories/openhands-software-agent-sdk-unauthenticated-sandbox-agent-server-rce)