Finding / openhands
2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backends
AnyIO TLS certificate-spoofing remediation reaches the Canvas v1.25.0 backends. The SDK workspace constraint and lock, and automation lock, move AnyIO to 4.14.2. CVE-2026-63374 / GHSA-82r6-8w77-94w6 concerns certificate spoofing for certain redirected TLS connections to internationalized hostnames: IDNA 2003 encoding can make the wrong encoded name validate. The advisory predates this window; OpenHands remediation is in-window. This is not a generic unauthenticated code-execution bug. Both newest backend locks still select 4.14.2.
Channel: tagged-release. Half: defect. Date: 2026-09-29 (SDK v1.50.0 and automation 1.15.2); 2026-10-06 (Canvas v1.25.0 bundle).
Operator consequence: Use the corrected released/locked builds and inspect AnyIO in the actual installed environment. A repository lock or workspace constraint does not prove what every uvx/PyPI resolver installed. No reachable OpenHands exploit or live installed environment was established here.
Receipt
- https://github.com/OpenHands/software-agent-sdk/commit/7fa122478a3d90710cc2525c51c02aec0867b252
- https://github.com/OpenHands/automation/commit/53f3209f4e4565c1d4cc6ca27b9f28a603ad905c
- https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.50.0
- https://github.com/OpenHands/automation/releases/tag/1.15.2
- https://github.com/advisories/GHSA-82r6-8w77-94w6
- https://github.com/OpenHands/software-agent-sdk/blob/v1.54.0/uv.lock
- https://github.com/OpenHands/automation/blob/1.19.3/uv.lock
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backends
Profile citations
- OpenHands / claim / anyio-remediation
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsgithub.com/OpenHands/software-agent-sdk/commit/7fa122478a3d90710cc2525c51c02aec0867b252commit2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsgithub.com/OpenHands/automation/commit/53f3209f4e4565c1d4cc6ca27b9f28a603ad905cgithub release2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsOpenHands/software-agent-sdk / v1.50.0github release2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsOpenHands/automation / 1.15.2official docs2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsgithub.com/advisories/GHSA-82r6-8w77-94w6tagged commit file2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsOpenHands/software-agent-sdk / uv.locktagged commit file2026-10-13-openhands-anyio-tls-certificate-spoofing-remediation-reaches-the-canvas-v1-25-0-backendsOpenHands/automation / uv.lock