{"id":"CVE-2026-46711","aliases":["EUVD-2026-90085"],"status":"published","title":"Soft Machine: Unauthenticated workspace API exposes arbitrary file read \u0026 directory exfiltration to any peer on the Fly private network","description":"Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/\u003cpath\u003e, /archive/\u003cdir\u003e) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00275,"percentile":0.20036,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2026-09-30T16:30:02Z","modified":"2026-09-30T19:57:08Z","products":[{"vendor":"embysupport","product":"security"},{"vendor":"soft-machine-io","product":"security"}],"references":[{"url":"https://github.com/Soft-Machine-io/security/security/advisories/GHSA-h6g6-qr45-qmrr","tags":["x_refsource_CONFIRM","exploit"]}],"sources":{"cve":[{"id":"CVE-2026-46711","title":"Soft Machine: Unauthenticated workspace API exposes arbitrary file read \u0026 directory exfiltration to any peer on the Fly private network","description":"Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/\u003cpath\u003e, /archive/\u003cdir\u003e) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.","status":"published","published":"2026-09-30T16:30:02.745Z","modified":"2026-09-30T17:02:21.234Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T13:46:55.086623Z"}],"euvd":[{"id":"EUVD-2026-90085","description":"Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/\u003cpath\u003e, /archive/\u003cdir\u003e) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.","status":"published","published":"2026-09-30T16:30:02Z","modified":"2026-09-30T17:02:21Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T17:27:48.536397Z"}],"nvd":[{"id":"CVE-2026-46711","description":"Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/\u003cpath\u003e, /archive/\u003cdir\u003e) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.","status":"published","published":"2026-09-30T17:16:46.06Z","modified":"2026-09-30T19:57:08.043Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:12:53.097633Z"}]}}