Evidence · DiggingBeagle record
OpenHands agent-server SDK PR 5209: restrict binding and session keys
OpenHands agent-server SDK PR 5209: restrict binding and session keys
- Source role
- primary disclosure
Evidence record
OpenHands agent-server SDK PR 5209: restrict binding and session keys
Claim-level citations (2)
- supportsOpenHands sandbox server accepted unauthenticated remote commands on exposed ports: OpenHands patch PR 5209 notes that its SDK client already connects through 127.0.0.1 while Docker had been publishing the agent API and optional VS Code ports on every host interface; the change confines those host mappings to loopback.
OpenHands PR 5209, Why, Summary and session API key forwarding
- supportsOpenHands sandbox server accepted unauthenticated remote commands on exposed ports: The OpenHands SDK patch changes agent-server host exposure and session authentication so an externally reachable control endpoint no longer accepts unauthenticated execution by default. The mitigation is associated with SDK 1.52.0.
PR 5209 description, changed host binding and session_api_keys, tests