Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-122236— OpenHands Landing missing authentication

Quick assessment

Affected

n/a OpenHands

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 OpenHands 1.24.0 及更早版本中发现一个漏洞。该漏洞影响组件“登录页面（Landing Page）”中某个未知功能，攻击者可通过操纵该功能绕过身份验证。此攻击必须从本地网络内部发起。利用方法已公开，可能被用于实际攻击。升级到版本 1.25.0 可修复此问题，相关补丁的提交哈希为 c5efa3ae415def0a903c82d2b17b748e663b1995。建议尽快升级受影响的组件。

CVSS 6.3 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1551 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenHands Landing missing authentication

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	OpenHands	1.0	`cpe:2.3:a:openhands:openhands::::::::`

II. Public POCs for CVE-2026-122236

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-122236

请登录查看更多情报信息。

Other References for CVE-2026-122236 (2)

Other References for CVE-2026-122236 (7)

https://github.com/OpenHands/OpenHands/releases/tag/v1.25.0 patch
https://github.com/OpenHands/OpenHands/issues/17878 exploit issue-tracking
https://github.com/OpenHands/OpenHands/commit/c5efa3ae415def0a903c82d2b17b748e663b1995 patch
https://github.com/OpenHands/OpenHands/pull/17007 issue-tracking patch
https://vuldb.com/vuln/431199/cti signature permissions-required
https://vuldb.com/cve/CVE-2026-122236 third-party-advisory
https://vuldb.com/submit/1031850 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-122236

Same Patch Batch · n/a · 2026-11-05 · 4 CVEs total

CVE-2026-122158	4.7 MEDIUM	InvoiceShelf MemberService.php create access control
CVE-2026-122151	4.3 MEDIUM	Presenton User Configuration user-config JSON.parse cross-site request forgery
CVE-2026-122052	4.3 MEDIUM	laspy LAS File lasreader.py memory allocation

IV. Related Vulnerabilities

Same product: OpenHands

Same vendor: n/a

Same weakness: CWE-306