CVE WATCH / VULNERABILITY DETAIL
CVE-2026-112346
CRITICALCVSS 9.8NVD feed
Published 26 October 2026 · tracked since 27 October 2026
Description
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by de
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog