OpenHands SDK 9.8 — sandbox control port bound to 0.0.0.0, API key hardcoded to None.Anyone who could reach the port had unauthenticated root in the container. Mounted workspace readable. Secrets store readable in plaintext.No exploit needed — the attack is an HTTP request to a service built to accept them.Fixed in 1.52.0 (Oct 5). CVE published Oct 26. Three-week lag.https://threataft.com/articles/openhands-agent-sdk-cve-2026-112346-sandbox-0-0-0-0#infosec #CVE #AI #Docker #RCE #OpenHands
Related
“By analyzing #NASA #lidar data, my #AI agents discovered a #Maya site in Mexico that, as far as anyone can tell, no one...
“By analyzing #NASA #lidar data, my #AI agents discovered a #Maya site in Mexico that, as far as anyone can tell, no one had reported before. It took less than 72 hours to go from ...
rtopy: an R to Python bridge -- noveltieshttps://thierrymoudiki.github.io/blog/2026/01/08/r/python/rtopy#Python #DataSci...
rtopy: an R to Python bridge -- noveltieshttps://thierrymoudiki.github.io/blog/2026/01/08/r/python/rtopy#Python #DataScience #MachineLearning #rstats #Techtonique
📰 Insector X - An unofficial AI fan port of Taito's 1989 horizontal shooter by caiusarcade {WIP}Caiusarcade has just rel...
📰 Insector X - An unofficial AI fan port of Taito's 1989 horizontal shooter by caiusarcade {WIP}Caiusarcade has just released an early build of an unofficial fan port of Taito's 19...