Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-122236 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:6.3 MEDIUMVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/OpenHands/OpenHands/	[email protected]	Vendor
https://github.com/OpenHands/OpenHands/commit/c5efa3ae415def0a903c82d2b17b748e663b1995	[email protected]	Source CodeVendor
https://github.com/OpenHands/OpenHands/issues/17878	[email protected]	ExploitIssue TrackingTechnical DescriptionVendor
https://github.com/OpenHands/OpenHands/pull/17007	[email protected]	Issue TrackingVendor
https://github.com/OpenHands/OpenHands/releases/tag/v1.25.0	[email protected]	Release NotesVendor
https://vuldb.com/cve/CVE-2026-122236	[email protected]	AdvisoryPermission Required
https://vuldb.com/submit/1031850	[email protected]	Issue TrackingPermission Required
https://vuldb.com/vuln/431199	[email protected]	AdvisoryPermission Required
https://vuldb.com/vuln/431199/cti	[email protected]	AdvisoryContent Wall

see all 9 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-287	Improper Authentication	[email protected]
CWE-306	Missing Authentication for Critical Function	[email protected]

Affected Products

Product	Versions
OpenHands	<= 1.24.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.25.0moderate effort Workaround:low effort Run the application with the "--public" flag. This will prevent the session key from being injected into the landing page. Mitigation:low effort Block inbound access to the ingress and static ports. Do not accept the application's firewall authorization prompt on first launch, as this will expose the ports to the local network.

Product

Versions

OpenHands

<= 1.24.0 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 1.25.0moderate effort
Workaround:low effort
Run the application with the "--public" flag. This will prevent the session key from being injected into the landing page.
Mitigation:low effort
Block inbound access to the ingress and static ports. Do not accept the application's firewall authorization prompt on first launch, as this will expose the ports to the local network.

Change History

2 change records found show changes

Date	Action	Recorded By
Nov 5, 2026	CVE Modified	CISA-ADP
Nov 5, 2026	New CVE Received	[email protected]