CVE-2026-112346: Critical Unauthenticated RCE in OpenHands Agent SDK Docker Workspaces — Detection and Remediation Guide

NVD has published CVE-2026-112346, a CVSS 9.8 (Critical), network-exploitable vulnerability in the OpenHands Software Agent SDK before version 1.52.0. The flaw is not an obscure memory corruption bug requiring a chained exploit — it is a catastrophic default configuration: the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to 0.0.0.0 with an empty session_api_keys list, which disables authentication entirely by default.

The practical consequence: any host that can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root inside the sandbox, access the mounted workspace, and — this is the part that should keep you up at night — read plaintext secrets from the secrets store. AI agent workloads are, by design, provisioned with API keys, cloud credentials, and repository tokens. This vulnerability turns every exposed OpenHands sandbox into a credential vending machine.

If your organization is running AI coding agents, autonomous DevOps agents, or any OpenHands-based automation with container networking exposed beyond localhost, treat this as an emergency change. This post breaks down the exposure, gives you detection logic your SOC can deploy today, and walks through remediation and hardening.

Technical Analysis

Affected Products and Versions

The vulnerability is in the SDK's workspace launcher logic — not the Docker Engine itself — but because OpenHands sandboxes are almost universally deployed as Docker containers, the blast radius tracks directly with your container estate.

How the Vulnerability Works

The failure is a classic insecure-by-default bind + missing authentication combination:

1. Binding to 0.0.0.0. When the DockerWorkspace or Apptainer launcher spins up the sandbox, the agent server inside the container listens on all interfaces rather than loopback. If the container port is published (-p flag, Docker Compose ports: mapping, or a Kubernetes NodePort/LoadBalancer service), the agent API is reachable from the network — potentially the internet if the host sits behind a permissive security group or firewall.
2. Empty session_api_keys list. The agent server's authentication layer keys off this list. An empty list does not fail closed — it disables authentication outright. Any HTTP or WebSocket client that can reach the port is treated as trusted.
3. Root-equivalent code execution. The agent server's job is to execute shell commands on behalf of the orchestrating LLM, and it does so as root inside the sandbox. An attacker's request is indistinguishable from a legitimate agent instruction.
4. Secrets exposure. The plaintext secrets store (mounted credentials, API keys, environment secrets provisioned for the agent's tasks) is readable through the same unauthenticated channel. Workspace mounts — often including checked-out source code and configuration — are equally exposed.

Exploitation requires only network reachability to the published port. No credentials, no user interaction, no special tooling — curl or a WebSocket client is sufficient.

Exploitation Status

As of this writing, CVE-2026-112346 has been published by NVD with a CVSS 9.8 (network attack vector, low complexity, no privileges, no user interaction). Given that the vulnerability is a trivially exploitable missing-authentication condition — and that AI agent infrastructure is a high-value, fast-growing target — defenders should assume opportunistic scanning and exploitation will follow disclosure rapidly, even if confirmed in-the-wild activity has not yet been publicly documented. Check the CISA Known Exploited Vulnerabilities catalog and the NVD entry for updates. Internet-exposed instances should be treated as presumed compromised and triaged accordingly (credential rotation first, forensics second).

Detection & Response

This is a technical threat, and the detection surface is concrete: an unauthenticated network service speaking HTTP/WebSocket and spawning shell commands as root from a containerized agent process. The rules below target those observable behaviors.

Sigma Rules

These rules assume you are forwarding container host audit logs, Docker daemon logs, or EDR telemetry from your AI agent hosts into a Sigma-compatible pipeline. The first rule targets shell execution from the agent server process; the second targets published-port exposure of agent workloads.

---
title: OpenHands Agent Sandbox Spawning Suspicious Shell Commands
id: 8b2f4a17-3c9e-4d51-b726-9a1e5c7d3f08
status: experimental
description: Detects shell interpreters and high-risk command execution spawned by containerized agent server processes, consistent with exploitation of unauthenticated agent APIs such as CVE-2026-112346 in the OpenHands Software Agent SDK.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-112346
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'agent_server'
      - 'openhands'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python'
      - '/python3'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  selection_cmdline:
    CommandLine|contains:
      - 'base64'
      - '/dev/tcp/'
      - 'chmod +x'
      - 'id;'
      - '/etc/shadow'
      - 'env |'
      - 'printenv'
  condition: selection_parent and selection_child and selection_cmdline
falsepositives:
  - Legitimate agent task execution will spawn shells; triage on command-line content (secrets enumeration, reverse shells, downloads) rather than execution alone
level: high
---
title: Docker Container Publishing OpenHands Agent Port to All Interfaces
id: 4d1c9e83-7a52-4b6f-ae19-2c8d3f6a5b47
status: experimental
description: Detects docker run or compose activity binding an OpenHands agent container port to 0.0.0.0, the exposure condition that makes CVE-2026-112346 remotely exploitable.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-112346
  - https://attack.mitre.org/techniques/T1610/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.defense_evasion
  - attack.t1610
logsource:
  category: process_creation
  product: linux
detection:
  selection_docker:
    CommandLine|contains:
      - 'docker run'
      - 'docker create'
  selection_publish:
    CommandLine|contains:
      - '-p 0.0.0.0:'
      - '-p :'
      - '--publish 0.0.0.0'
      - '--network=host'
      - '--network host'
  selection_image:
    CommandLine|contains:
      - 'openhands'
      - 'agent_server'
  condition: selection_docker and selection_publish and selection_image
falsepositives:
  - Development environments intentionally exposing agent ports; treat any hit on production or internet-reachable hosts as critical
level: critical

KQL — Microsoft Sentinel / Defender

If your container hosts ship Syslog or CEF into Sentinel, this query hunts for both the exposure condition and post-exploitation command execution. Run it over at least the last 30 days to establish whether exposure predated disclosure.

// Hunt 1: Shell execution inside agent containers consistent with CVE-2026-112346 exploitation
Syslog
| where TimeGenerated > ago(30d)
| where ProcessName has_any ("bash", "sh", "python", "curl", "wget", "nc", "ncat")
| where SyslogMessage has_any ("agent_server", "openhands")
   or SyslogMessage has_any ("/etc/shadow", "printenv", "base64 -d", "/dev/tcp/")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;

// Hunt 2: Network connections to published agent container ports from non-local sources
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor =~ "Docker" or Message has "openhands" or Message has "agent_server"
| where not (SourceIP startswith "10." or SourceIP startswith "192.168." or SourceIP startswith "172.1" or SourceIP == "127.0.0.1")
| summarize ConnectionCount = count(), DistinctSources = dcount(SourceIP) by DestinationIP, DestinationPort, SourceIP
| order by ConnectionCount desc;

Adjust the private-range filter in Hunt 2 to match your authorized agent orchestration subnets — legitimate LLM orchestrators will connect from known infrastructure, and anything outside that set is suspect.

Velociraptor VQL

For live triage of a suspected-exposed agent host, this artifact enumerates processes and listeners to confirm whether the agent server is bound to 0.0.0.0 and whether unexpected shells are running under it.

-- Identify agent server listeners on non-loopback addresses and their child processes
SELECT n.Pid AS ListenerPid, n.Name AS ListenerName, n.Laddr AS BindAddress,
       n.Lport AS BindPort, n.Status AS ConnStatus,
       p.CommandLine AS ListenerCmdline, p.Username AS RunAs
FROM netstat() n
JOIN pslist() p ON n.Pid = p.Pid
WHERE (n.Name =~ 'agent_server|python|node' OR p.CommandLine =~ 'openhands|agent_server')
  AND n.Laddr =~ '^(0\\.0\\.0\\.0|::)$'

A hit here confirms the vulnerable exposure condition on that host — escalate to containment immediately and pull container logs before teardown.

Bash Audit and Remediation Script

Run this on Docker hosts that may be running OpenHands agent workloads to identify exposed instances and verify the SDK version.

#!/bin/bash
# CVE-2026-112346 exposure audit for OpenHands agent containers
# Run as root on each Docker host

echo "=== [1] Containers with ports published to 0.0.0.0 ==="
docker ps --format '{{.ID}} {{.Image}} {{.Ports}}' | while read -r id image ports; do
  if echo "$ports" | grep -qE '0\.0\.0\.0:|:::'; then
    if echo "$image" | grep -qiE 'openhands|agent'; then
      echo "[EXPOSED] $id $image -> $ports"
    fi
  fi
done

echo "=== [2] SDK version inside running agent containers ==="
for id in $(docker ps -q); do
  image=$(docker inspect -f '{{.Config.Image}}' "$id")
  if echo "$image" | grep -qiE 'openhands|agent'; then
    ver=$(docker exec "$id" pip show openhands-ai 2>/dev/null | grep -i '^Version' || echo "unknown")
    echo "$id ($image): $ver"
  fi
done

echo "=== [3] Processes bound to 0.0.0.0 matching agent server ==="
ss -tlnp | grep -E '0\.0\.0\.0' | grep -iE 'python|node|agent' || echo "none found"

echo "=== [4] Emergency mitigation: restrict published ports to loopback ==="
echo "For each exposed container, recreate with: docker run -p 127.0.0.1:<port>:<port> ..."
echo "Or apply host firewall rule, e.g.:"
echo "  iptables -I DOCKER-USER -p tcp -m conntrack --ctorigdstport <AGENT_PORT> ! -s 127.0.0.1 -j DROP"

Remediation

1. Upgrade to OpenHands Software Agent SDK 1.52.0 or later immediately. This is the only complete fix — it corrects both the default bind behavior and the authentication bypass condition. Rebuild and redeploy agent images; do not patch in place on running containers.
2. Audit for exposure before and during patching. Use the script above plus cloud security group / firewall review to enumerate every published agent port. Any agent container port reachable from outside the orchestration network is an incident, not a finding.
3. Bind to loopback by policy. Where ports must be published, use 127.0.0.1:<port>:<port> mappings or front the service with an authenticated reverse proxy. Never expose the agent API directly.
4. Enforce non-empty session_api_keys. If you maintain custom launcher configuration, verify the session API key list is populated and authentication is enforced. Add a startup assertion that fails the launcher if the list is empty — fail closed, always.
5. Rotate all secrets provisioned to any exposed instance. Treat API keys, cloud tokens, repository credentials, and anything in the secrets store as compromised for every sandbox that was network-reachable while vulnerable. This includes credentials reachable from the sandbox (mounted kubeconfigs, SSH keys, cloud instance metadata).
6. Isolate agent workloads at the network layer. Run agent sandboxes on dedicated egress-controlled subnets or VPCs, deny inbound from anything except the orchestrator, and restrict egress to required API endpoints. AI agents do not need to be internet-reachable servers.
7. Review logs for prior exploitation. If any instance was internet-exposed, assume compromise: review HTTP/WebSocket access patterns, container process histories, and outbound connections from the sandbox before teardown. Preserve container filesystem layers for forensics.
8. Monitor CISA KEV and NVD. Track the NVD entry for CVE-2026-112346 for exploitation status updates and any vendor advisory revisions.

The deeper lesson here extends beyond OpenHands: AI agent infrastructure is production infrastructure. These sandboxes run as root, hold plaintext credentials, and execute attacker-influenceable instructions by design. They deserve the same network segmentation, authentication enforcement, and detection coverage as any internet-facing service — arguably more.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub