What happened
The Docker/Apptainer workspace launchers started the sandbox agent server on 0.0.0.0 with an empty session_api_keys list, so the agent server's own authentication was disabled by default. The fix commit changes port publication to loopback-only (127.0.0.1:8010:8000) and forwards a session key so the client and server agree. Confirmed via NVD (CVSS 9.8) and the fix commit.
Why it matters
OpenHands is the sandbox agent runtime for a popular autonomous coding-agent platform; a default-on, unauthenticated RCE means any network-reachable agent sandbox hands an attacker root execution plus access to the host's mounted workspace and stored secrets. This is a designed-to-be-agent-executed environment, so remote shell execution is a direct path to host and cloud-credential compromise.
Attack vector
The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. An unauthenticated attacker who can reach the published container port sends HTTP/WebSocket requests to execute arbitrary shell commands as root inside the sandbox, access the mounted workspace, and read plaintext secrets.
Affected systems
OpenHands Software Agent SDK before 1.52.0 (all versions from 0 to <1.52.0).
Mitigation
Upgrade to OpenHands Software Agent SDK 1.52.0. The fix binds published ports to loopback (127.0.0.1) and forwards/validates a session API key.".