OpenHands Software Agent SDK versions prior to 1.52.0 expose a sandbox agent server that listens on all network interfaces (0.0.0.0) with an empty session_api_keys list. This configuration disables authentication, allowing anyone who can reach the exposed container port to send unauthenticated HTTP and WebSocket requests. The payload execution mechanisms in DockerWorkspace and Apptainer workspace launchers do not properly validate command inputs, enabling an attacker to execute arbitrary shell commands as root within the sandbox environment. The attacker gains full control over the sandbox, can access the mounted workspace, and read plaintext secrets from the secrets store, potentially compromising sensitive data and system integrity.

The vulnerability affects OpenHands Software Agent SDK, specifically versions earlier than 1.52.0. No particular sub‑version range is listed beyond the noted cutoff, so all releases before 1.52.0 are considered impacted.

The CVSS score of 9.3 indicates a critical severity. The EPSS score is not available, so the exact likelihood of exploitation is uncertain, but the absence of a KEV listing suggests there is no documented widespread exploitation yet. Nevertheless, the vulnerability requires only network reachability to the published container port, and no authentication or privileged credentials are needed. Attackers can exploit this vector to run arbitrary code as root, making the risk high for any exposed instance.