AIKIDO-2026-781100
openhands-agent-server is vulnerable to Insertion of Sensitive Information into Externally Accessible File or Directory
55
Medium Risk
This Affects:
openhands-agent-serverTL;DR
The agent server stores user settings and secrets through file-based stores whose default persistence directory is workspace-relative when the persistence-directory environment variable is unset. In that default mode, saving settings or secrets writes credential-bearing settings.json and secrets.json files, including plaintext LLM API keys, into the project workspace. Any process or user with workspace access can read these files, and they are easily committed to version control, exposing the stored credentials. The fix routes the settings and secrets stores to the user profile persistence directory outside the workspace.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the agent server runs without OH_PERSISTENCE_DIR configured, so settings and secrets fall back to a workspace-relative directory.
Background info
openhands-agent-server is vulnerable to Insertion of Sensitive Information into Externally Accessible File or Directory in versions 1.21.0 - 1.39.1.
How to fix this
Upgrade the openhands-agent-server library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant