OpenHands Software Agent SDK — CVE-2026-112346 (Critical)

Date Oct 26, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product OpenHands · Software Agent SDK

CVE CVE-2026-112346

Critical vendor advisory CVE-2026-112346

Summary

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in OpenHands Software Agent SDK. Patch or mitigate promptly. EPSS percentile: 63%.

Operator check

Review CVE-2026-112346 in your asset inventory. Apply patches per vendor guidance and verify Software Agent SDK is not exposed. CVSS score: 9.8. EPSS probability: 1.0%; percentile: 63%.

Sources

NVD — CVE-2026-112346 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed