OpenHands Software Agent SDK CVE-2026-112346 (GHSA-rp7h-crm7-h5qj, critical): DockerWorkspace / Apptainer sandbox agent server listens on 0.0.0.0 with no API key, allowing unauthenticated command execution. Which versions and how do I fix it?

What it is: In the OpenHands Software Agent SDK before 1.52.0, the DockerWorkspace and Apptainer workspace launchers started the sandbox's agent server bound to all network interfaces (0.0.0.0) with an empty list of session API keys, which turns authentication off. Anyone who can reach the published container port can send HTTP or WebSocket requests that run shell commands as root inside the sandbox, read the mounted workspace, and read secrets from the SDK's secrets store in plain text. The advisory was published October 26, 2026 (VulnCheck); the fixed release, 1.52.0, shipped earlier in October. Am I affected: - You use the OpenHands Software Agent SDK (openhands-sdk / software-agent-sdk) below 1.52.0 with DockerWorkspace or Apptainer workspaces. - Exposure depends on who can reach the sandbox's published port: other machines on your LAN, cloud VPC, CI network, or the internet if the host has a public IP and no firewall. - Check with pip show for the installed SDK package, and docker ps (PORTS column) for sandbox ports published on 0.0.0.0. Fix: 1. Upgrade the SDK to 1.52.0 or later and restart running sandboxes so they come up with the new defaults. 2. Until you can, don't publish sandbox ports beyond localhost: bind published ports to 127.0.0.1, and block them with a host or cloud firewall. 3. Set session API keys explicitly if your setup exposes the agent server on purpose, and keep secrets out of sandboxes that don't need them. 4. If an affected sandbox port was reachable from a network you don't control, rotate every secret the SDK's secrets store held (LLM provider keys, GitHub tokens, cloud keys) and review the mounted workspace for changes you didn't make. Verify: the installed SDK reports 1.52.0+, docker ps shows sandbox ports bound to 127.0.0.1 (or not published), and an unauthenticated request to the agent server from another host is refused. Sources: https://github.com/advisories/GHSA-rp7h-crm7-h5qj https://nvd.nist.gov/vuln/detail/CVE-2026-112346 https://www.vulncheck.com/advisories/openhands-software-agent-sdk-unauthenticated-sandbox-agent-server-rce https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.52.0