openhands/software-agent-sdk vulnerabilities

Latest openhands/software-agent-sdk CVEs

Newest publication first

1. CVE-2026-112346 OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE

   Published 2026-10-26

   Critical·CVSS 9.3

   OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.