CVE-2026-122236

MediumCVSS 6.3

Published: 05/11/2026(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

30th percentile - higher than 30% of all known CVEs

Summary

A vulnerability was found in OpenHands up to 1.24.0 affecting an unknown function of the Landing Page component, leading to missing authentication. The attack must be carried out from within the local network, and the exploit has been publicly disclosed and may be used.

Risk Assessment

Missing authentication in the Landing Page component may allow a local-network attacker to gain unauthorized access to application functions, risking data exposure and further exploitation.

Recommendation

Upgrade OpenHands to version 1.25.0, which contains the fix (commit c5efa3ae415def0a903c82d2b17b748e663b1995). Restrict local-network access to the application to trusted hosts.

Other vulnerabilities in OpenHands

CVE-2026-19022Medium
A vulnerability was found in OpenHands up to 0.62.0. The affected function is initialize_repo in OpenHands/resolver/send_pull_request.py, allowing command injection. Remote exploitation is possible. The vendor deleted the original GitHub issue, and the affected file was removed in version 1.7.0.

Original NVD description (English source)

A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS