Openhands Software Agent Sdk
Approved changes feed: RSS · Atom
cpe:2.3:a:openhands:openhands_software_agent_sdk:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Openhands (bbec22cd-73ef-59b9-9356-3141cf863e1d) |
|---|---|
| Product | Openhands Software Agent Sdk (3d9b9c17-1c18-5ce4-a5e2-dd514c2c6aae) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-112346 |
vulnerable | 2026-11-03 10:16:28.081846 |
OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
CRITICAL (9.8)
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
Published: 2026-10-26T15:34:30.749Z
Updated: 2026-11-04T19:16:39.224Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.