OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.52.0
- Public exploit
- None on Exploit-DB
Summary
The OpenHands Software Agent SDK, specifically its Docker and Apptainer workspace launchers, is affected. An attacker who can reach the exposed sandbox port without logging in could run arbitrary commands as root, access the mounted workspace, and read stored secrets in plain text.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
Affected versions
- OpenHands OpenHands Software Agent SDK
fixed in 1.52.0