A coding-agent sandbox that listens on every interface with the API key left blank is a root shell with a port number.
On 26 October 2026, CVE-2026-112346 landed for OpenHands Software Agent SDK before 1.52.0. The bug is almost embarrassingly structural: publish 8000 and 8001 on 0.0.0.0, set the session key to none, and wait for whoever can route to the host.
Unauthenticated root shell through the published agent port
OpenHands Software Agent SDK workspace launchers (DockerWorkspace and Apptainer paths) start a sandbox agent HTTP/WebSocket server and an optional VS Code port. Before 1.52.0, DockerWorkspace._start_container() published those ports as -p {host_port}:8000 and -p {host_port + 1}:8001, which on Docker means 0.0.0.0 and iptables DOCKER rules that can bypass host ufw / firewalld input chains. The launcher also hardcoded self.api_key = None rather than reading OH_SESSION_API_KEYS_0 or SESSION_API_KEY, leaving session_api_keys empty and authentication off.
Any attacker who can reach the published port can send unauthenticated HTTP or WebSocket requests, execute arbitrary shell commands as root inside the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store. CVE records list CWE-1327 (binding to an unrestricted IP address). CVSS 3.1 is 9.8; CVSS 4.0 on the CVE record is 9.3. Credit: mil4n. Fixed release: 1.52.0 (commit 7b66584ff8), which binds published ports to 127.0.0.1 and forwards the session-key environment variables into api_key.
Agent sandboxes became LAN-reachable control planes
Coding agents increasingly run privileged tool loops inside Docker or Apptainer workspaces on developer laptops and shared CI runners. Teams assumed "sandbox" meant unreachable from the next desk. CVE-2026-112346 shows the default publish path made the agent control plane a network service. That sits in the same October week as other agent-tool boundary failures, and it is distinct from earlier Aider config and MCP filesystem patches: here the failure is bind address plus empty auth rather than path allowlisting.
Open SDK; maturity is patch-and-set-the-key
OpenHands Software Agent SDK is the public agent SDK line (openhands-sdk, openhands-workspace on PyPI). Activity: fix merged into 1.52.0 around 3 October 2026; CVE published 26 October. Corgea notes 1.58.2 as a current PyPI line at digest time. Maturity reading for this news: treat any host still launching workspaces below 1.52.0 with published 8000/8001 as overdue. Demo-only loopback after upgrade is usable; production-shaped only after a non-empty session key is configured and verified.
Upgrade past 1.52.0, bind loopback, set OH_SESSION_API_KEYS_0
If you run OpenHands workspaces on shared networks or cloud VMs, upgrade openhands-sdk and openhands-workspace to 1.52.0 or later tonight, stop containers that still show 0.0.0.0:*->8000/tcp, and set a non-empty OH_SESSION_API_KEYS_0 (or SESSION_API_KEY). The loopback port fix alone does not invent a key: if the environment variable is unset, authentication can remain empty. Re-scan running Docker publishes with docker ps for sandbox ports before you call the incident closed.
Loopback complacency, empty keys, and Docker RULE bypass myths
Operators who upgrade to 1.52.0 and skip the env key recreate half the bug. Operators who firewall INPUT only and ignore Docker's DOCKER chain may still have been reachable before the bind fix. Laptop demos on public Wi-Fi with old SDKs are in scope: "local sandbox" was network-local to everyone on the segment. Apptainer launchers sharing the same empty-key pattern need the same audit even if your fleet is Docker-first.
Close the published port before the next agent session
Pin OpenHands workspace packages at or above 1.52.0, require session keys in every compose file, and add a CI check that fails if sandbox ports publish on 0.0.0.0. The open Monday question is how many shared runners still expose an unauthenticated agent port from an image frozen before the October CVE wave.