AIKIDO-2026-781100

openhands-agent-server is vulnerable to Insertion of Sensitive Information into Externally Accessible File or Directory

Pre-CVE Published Aug 4, 2026

CVE Score

Medium

Insertion of Sensitive Information into Externally Accessible File or Directory

TL;DR

The agent server stores user settings and secrets through file-based stores whose default persistence directory is workspace-relative when the persistence-directory environment variable is unset. In that default mode, saving settings or secrets writes credential-bearing settings.json and secrets.json files, including plaintext LLM API keys, into the project workspace. Any process or user with workspace access can read these files, and they are easily committed to version control, exposing the stored credentials. The fix routes the settings and secrets stores to the user profile persistence directory outside the workspace.

How do I fix this?

Upgrade the openhands-agent-server library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and the agent server runs without OH_PERSISTENCE_DIR configured, so settings and secrets fall back to a workspace-relative directory.