Evidence record / openhands
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-openhands-canvas-v1-26-0-adds-explicit-organization-scope-to-cloud-conversation-requests
Canvas v1.26.0 adds explicit organization scope to Cloud conversation requests. The Cloud proxy sends X-Org-Id from the active backend organization, and both paginated listing and individual-conversation queries wait until an organization is selected. This repairs missing or incorrect org context; the receipt does not itself establish cross-tenant unauthorized access.
Channel: tagged-release. Half: both. Date: 2026-10-08 (Canvas v1.26.0).
Operator consequence: Use Canvas v1.26.0 or later for multi-org Cloud conversation work. Confirm selected organization and request headers when diagnosing missing or stale lists, and test switching organizations. Do not turn the client context repair into an unproven tenant-isolation incident.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-openhands-canvas-v1-26-0-adds-explicit-organization-scope-to-cloud-conversation-requests
Profile citations
- OpenHands / claim / cloud-conversation-org-scope
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-openhands-canvas-v1-26-0-adds-explicit-organization-scope-to-cloud-conversation-requestsgithub.com/OpenHands/OpenHands/commit/96bcee6a4f9a69b99f8cfa1315681228f82b3557git compare2026-10-13-openhands-canvas-v1-26-0-adds-explicit-organization-scope-to-cloud-conversation-requestsgithub.com/OpenHands/OpenHands/compare/v1.25.0...v1.26.0github release2026-10-13-openhands-canvas-v1-26-0-adds-explicit-organization-scope-to-cloud-conversation-requestsOpenHands/OpenHands / v1.26.0
Versioned source: run artifact