AIKIDO-2026-807360

openhands-agent-server is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Pre-CVE Published Aug 4, 2026

CVE Score

Medium

Exposure of Sensitive Information to an Unauthorized Actor

TL;DR

The download-trajectory endpoint zips the raw conversation directory into a downloadable archive without masking its contents. Serialized conversation state such as base_state.json and meta.json embeds the agent and condenser LLM API keys, either in plaintext when no secret key is configured or as recoverable Fernet ciphertext when one is. Anyone who obtains an exported trajectory archive therefore recovers usable credentials, including cipher-encrypted custom secrets stored in the secret registry. The fix redacts secret-bearing fields and Fernet-encrypted values at the export boundary before the archive is written.

How do I fix this?

Upgrade the openhands-agent-server library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you export or share a conversation trajectory produced by the download-trajectory endpoint.