CVE-2026-122236 in OpenHands
Summary
by MITRE • 11/05/2026
A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in OpenHands versions up to 1.24.0 represents a critical authentication bypass within the Landing Page component, specifically affecting an internal function responsible for access control validation. This flaw allows attackers who are positioned on the local network to manipulate requests and gain unauthorized access to protected resources without providing valid credentials. The root cause lies in the failure of the application logic to properly enforce authentication checks before processing specific landing page interactions or API calls associated with that component. By exploiting this gap, an adversary can bypass security controls entirely, effectively treating authenticated endpoints as public-facing services accessible to any user on the same network segment.
From a technical perspective, this issue aligns closely with CWE-287, which describes Improper Authentication, and more specifically reflects patterns found in CWE-306 regarding Missing Authentication for Critical Function. The vulnerability is not merely a configuration error but likely stems from flawed code logic where authentication middleware or decorators were either omitted or incorrectly applied to specific routes within the landing page module. Because the exploit requires local network access, it suggests that the application may be binding services in a manner that trusts internal traffic implicitly or fails to validate session tokens and identity assertions for these particular endpoints. This creates a significant risk vector where any device connected to the same LAN can potentially hijack sessions or execute administrative actions without detection by standard perimeter defenses designed to stop external attacks.
The operational impact of this vulnerability is severe, as it compromises the integrity and confidentiality of the OpenHands environment. An attacker with local network access could use this flaw to escalate privileges, exfiltrate sensitive data stored within the application context, or modify system configurations depending on the permissions associated with the landing page functions. Since the exploit has been publicly disclosed, automated scanning tools and malicious actors actively monitoring for known vulnerabilities in open-source projects can easily locate and leverage this weakness against unpatched instances. This significantly increases the likelihood of successful compromise compared to zero-day scenarios where exploitation techniques are not yet widely available.
To mitigate this risk, immediate action is required to upgrade OpenHands to version 1.25.0 or later, which incorporates the patch identified by commit hash c5efa3ae415def0a903c82d2b17b748e663b1995. This update corrects the underlying logic error that allowed authentication to be bypassed on the landing page component. In addition to upgrading, organizations should implement network segmentation strategies to restrict access to development and internal tooling environments from general user networks. Deploying intrusion detection systems capable of identifying exploitation attempts for this specific CVE can provide an additional layer of defense while patching is being rolled out across infrastructure assets. Regular vulnerability assessments and adherence to secure coding standards that mandate explicit authentication checks on all endpoints are essential preventive measures against similar flaws in the future.