CVE-2026-46711: Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network
Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated instances.internal TXT record, every other sm-ws- machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any host that can reach TCP port 8080 on an affected workspace can exploit it. In the described deployment, this includes other sm-ws-* machines on the same Fly app or organization because they share the Fly private 6PN and can discover peer addresses through _instances.internal.
Does an attacker need credentials or user interaction?
No. The exposed /file/<path> and /archive/<dir> endpoints have no authentication or origin check, and exploitation does not require user interaction.
What data can be accessed?
An attacker can read arbitrary files under the affected workspace's /workspace root. They can also download entire project directory trees as tar archives through the archive endpoint.
Which versions are affected, and is a patch available?
Soft Machine versions 0.2.247 and earlier are affected. At the time of publication, no publicly known patches were available.
What can be done if patching is not available?
Restrict access to TCP/8080 so that untrusted peer machines cannot reach the workspace HTTP service. The issue exists because the service listens on 0.0.0.0:8080 without authentication or origin checks.