OpenHands SDK and Google's MCP Toolbox Fix Critical Flaws in Self-Hosted AI Agent Tools. Update Now

TL;DR: Two open-source tools that people run themselves to give AI agents a workspace or a database connection have critical flaws, both disclosed on October 26. In the OpenHands Software Agent SDK, CVE-2026-112346 (rated 9.8 on CVSS 3.1 by VulnCheck, which assigned it) let anyone who could reach an agent’s sandbox port run shell commands in it as root and read the secrets stored there, because the sandbox’s server had no password by default. It affects versions before 1.52.0. In Google Cloud’s MCP Toolbox for Databases, CVE-2026-93328 (rated 9.3 on CVSS 4.0 by Google Cloud, which assigned it) lets an unauthenticated attacker copy files from the server to their own Cloud Storage bucket and overwrite files on it, in versions 1.2.0 through 1.4.0. Both fixes shipped before the disclosures: OpenHands 1.52.0 on October 5 and Toolbox 1.5.0 on June 18. But upgrading may not be enough on its own. Toolbox’s new allow-lists allow everything until you fill them in, and OpenHands’ fix covers its Docker launcher, not the Apptainer launcher the CVE also names. Neither flaw is on CISA’s exploited list, and we found no reports of attacks.

What happened

OpenHands Software Agent SDK, CVE-2026-112346. The SDK is a Python toolkit for building AI agents. Its workspace launchers start a sandbox (a Docker or Apptainer container) where the agent runs commands. The CVE, published October 26 by VulnCheck, which assigned it, says the DockerWorkspace and Apptainer launchers “bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default.” Anyone who can reach the published port “can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.” VulnCheck credits a researcher named mil4n and scores it 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0.

The CVE lists every version before 1.52.0 as affected. The fix, pull request #5209, “fix(workspace): publish Docker ports on loopback,” shipped in v1.52.0 on October 5. It makes Docker publish the sandbox’s ports only on 127.0.0.1, the machine’s own address, and passes a session key to the client if you set one. The release notes don’t call it a security fix, and OpenHands has published no advisory of its own; the disclosure is VulnCheck’s.

Our reading of the code, not an OpenHands statement: the fix changes only the Docker launcher. In the newest release, 1.58.2 (October 25), the Apptainer launcher still starts the agent server with --host 0.0.0.0, and the server’s settings still default to no session key unless one is set in the environment. Whether Apptainer users are protected by upgrading isn’t confirmed. Setting a session key closes the open door either way.

Google Cloud MCP Toolbox for Databases, CVE-2026-93328. Toolbox is Google’s open-source MCP server for databases. MCP is the protocol AI assistants use to call outside tools. The CVE, published October 26 by Google Cloud, says a “Path Traversal and Missing Authorization in cloud-storage source” in versions 1.2.0 through 1.4.0 “allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.” Google Cloud scores it 9.3 on CVSS 4.0, gives no CVSS 3.1 score, and credits He Wei (gikaku). CISA’s added data on the record rates exploitation “none” and the flaw “automatable.”

The fix, pull request #3454, “restrict bucket and local path access,” shipped in v1.5.0 on June 18, four months before the CVE. Its description says: “Add allowedBuckets and allowedLocalRoot. Defaults to allow all.” The settings are named allowedBuckets and allowedLocalRoots in the code. In the newest release, 1.15.0 (October 23), the Cloud Storage source docs still say: “If allowedLocalRoots is omitted, every absolute path the server process can reach is allowed,” and that if allowedBuckets is omitted, “all buckets are allowed.” Google’s ready-made Cloud Storage config sets neither list, and it includes the upload and download tools. Google has published no advisory or bulletin of its own that we could find.

Both GitHub advisories (GHSA-rp7h-crm7-h5qj and GHSA-2gc9-c85v-5vwr) are unreviewed copies of the CVE text, and NVD hasn’t analyzed either CVE yet. As of our check, neither is in CISA’s Known Exploited Vulnerabilities catalog, and we found no reports of attacks.

Why it matters

Both tools hand an AI agent real access: a shell, your code, your secrets, your cloud storage. If you run an agent on a server, a cloud VM or a shared office machine, any device that can reach the sandbox or Toolbox port could use these flaws without logging in. On the OpenHands side, that means running commands as root inside the sandbox and reading the API keys you gave the agent.

The second lesson is that an upgrade isn’t always the whole fix. Toolbox 1.5.0 gives you a lock but leaves it open, and OpenHands’ fix changes the default network address for Docker only. In both cases, you need a setting to finish the job.

This is the same pattern as the OpenCode MCP sign-in flaw and the Postiz flaws: self-hosted AI and automation tools hold keys to everything else, so they need the same patch routine as any server.

What to do now

1. Find out if you use either tool. OpenHands’ SDK installs as Python packages named openhands-sdk and openhands-workspace; run pip show openhands-sdk openhands-workspace. For Toolbox, check the version of the toolbox binary or the container image tag you deploy.
2. OpenHands: upgrade to 1.52.0 or later. 1.58.2 is the newest. Anything older publishes the sandbox port on every network interface when you use DockerWorkspace.
3. Our advice: set a session key. Before launching a workspace, set both OH_SESSION_API_KEYS_0 and SESSION_API_KEY to the same long random value. Both launchers forward them into the sandbox, and the agent server then rejects requests without the key. In our reading of the 1.58.2 code, the Docker launcher’s client sends OH_SESSION_API_KEYS_0 but the Apptainer launcher’s client sends only SESSION_API_KEY, so setting just one can lock your own agent out. If you use the Apptainer workspace, this is the step that matters most, because in our reading its launcher still listens on all interfaces.
4. Toolbox: upgrade to 1.5.0 or later, then set the allow-lists. 1.15.0 is the newest. In each cloud-storage source, add allowedBuckets with only your own bucket names and allowedLocalRoots with only the folders Toolbox needs. Without them, the upgrade changes nothing about which buckets and files it can touch.
5. Our advice: drop the tools you don’t use. If your agent only reads from Cloud Storage, leave the upload and download tools out of your Toolbox configuration.
6. Our advice: keep both off the network. Toolbox listens on 127.0.0.1 by default; if you changed that, put it behind a firewall or an authenticated proxy. Do the same for any OpenHands sandbox port.
7. Rotate if you were exposed. If either tool was reachable from other machines on an affected version, rotate the keys and tokens the agent or the server could read. The Railway disclosure story has the routine.

Steps 3, 5, 6 and 7 are our own advice, not the vendors’ instructions.

Updates

• Oct 27, 2026, 3:36 p.m. Manila: First published, covering CVE-2026-112346 (OpenHands Software Agent SDK, fixed in 1.52.0) and CVE-2026-93328 (MCP Toolbox for Databases, fixed in 1.5.0). We’ll add a dated note if OpenHands or Google publishes its own advisory, if OpenHands changes the Apptainer launcher, or if attacks are reported or CISA lists either flaw.

Sources & method

Sources

• VulnCheck, “OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE,” Oct 26, 2026
• CVE records: CVE-2026-112346 (CNA: VulnCheck) and CVE-2026-93328 (CNA: Google Cloud; CISA ADP data)
• NVD entries: CVE-2026-112346 and CVE-2026-93328
• GitHub Advisory Database (unreviewed): GHSA-rp7h-crm7-h5qj (CVE-2026-112346) and GHSA-2gc9-c85v-5vwr (CVE-2026-93328)
• OpenHands: v1.52.0 release notes, pull request #5209, fix commit 7b66584 and v1.58.2 release notes
• OpenHands source at v1.58.2: Apptainer launcher, Docker launcher and agent server settings
• Google MCP Toolbox: v1.5.0 release notes, pull request #3454 and v1.15.0 release notes
• Google MCP Toolbox at v1.15.0: Cloud Storage source docs, ready-made Cloud Storage config and server flags (default address 127.0.0.1)
• CISA Known Exploited Vulnerabilities catalog and KEV data feed (JSON)

Method. Checked October 27, 2026, from 1:03 p.m. to 3:36 p.m. Manila time (05:03 to 07:36 UTC). The affected and fixed versions, descriptions, scores and credits come from the CVE records, VulnCheck’s advisory and the GitHub advisories; release dates and fix contents come from the two GitHub repositories. Dates are in UTC unless marked Manila. KEV status comes from CISA’s data feed (catalog version 2026.10.26). The notes on the Apptainer launcher, the session-key default and which key each launcher’s client sends, Toolbox’s default address and the ready-made config are our own reading of each project’s source code at the newest release; neither vendor has said this. Steps marked as our advice are our own judgment. We used no press coverage. No affiliate links on this page. How we work.