AIKIDO-2026-129575

openhands-agent-server is vulnerable to Binding to an Unrestricted IP Address

Pre-CVE Published Aug 5, 2026

CVE Score

High

Binding to an Unrestricted IP Address

TL;DR

The agent server command-line entry point defaults its bind host to 0.0.0.0 for every launch, even when no session API key is configured. In that mode the HTTP and WebSocket API, which can start conversations and run file and command operations in a workspace, is reachable from any host that can route to the machine without authentication. An unauthenticated network peer can then drive the agent server and execute operations in its workspace. The fix defaults the bind host to 127.0.0.1 when no session API key is set and warns when an explicit wildcard bind is used without a key.

How do I fix this?

Upgrade the openhands-agent-server library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the agent server without a configured session API key on a network-reachable interface.