Hi everyone :wave:
I wanted to follow up on a secu...
# questionsj
jolly-branch-70898
07/21/2026, 5:30 PMHi everyone 👋
I wanted to follow up on a security advisory I submitted about a month ago: github.com/OpenHands/OpenHands/…/GHSA-4c82-v9jg-gm8v
I haven't heard back yet, and I'd like to know whether it's being considered a valid finding, if you need any more information from me, or if you'd prefer to close it. Just looking for some clarity on the status so I know how to proceed.
Thanks, looking forward to hearing from you!
🙌 1
w
wooden-umbrella-84098
07/21/2026, 5:48 PMHmm thank you for raising--we are currently getting inundated with agent-generated slop ðŸ«
agent-server being unauthenticated is intended, BUT we should not be binding to 0.0.0.0 by default!
wooden-umbrella-84098
07/21/2026, 5:48 PMRaising priority here
j
jolly-branch-70898
07/21/2026, 6:29 PMThanks!
jolly-branch-70898
07/21/2026, 6:31 PMbut i think the main issue is that the Auth is not forced... is the session key is not seted (for example if you install the SDK from PIP), it works without creds
nod 1