CVE-2026-46711

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-55176

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth and authenticateWorkspaceHttp — accept the global CONTAINERSHAREDSECRET as a bearer token without verifying which...

EUVD-2026-90190

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth and authenticateWorkspaceHttp — accept the global CONTAINERSHAREDSECRET as a bearer token without verifying which...

CVE-2026-55176 Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth and authenticateWorkspaceHttp — accept the global CONTAINERSHAREDSECRET as a bearer token without verifying which...

CVE-2026-55176 Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth and authenticateWorkspaceHttp — accept the global CONTAINERSHAREDSECRET as a bearer token without verifying which...

CVE-2026-55176

In Soft Machine versions 0.2.247 and prior , an authentication bypass exists in the /app/server.js file. The helper functions verifyContainerAuth() and authenticateWorkspaceHttp() incorrectly accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying workspace ownership. Since ...

CVE-2026-46711

In Soft Machine versions 0.2.247 and prior , the workspace HTTP service listening on 0.0.0.0:8080 within sm-ws- Fly Machines * lacks authentication and origin checks. This vulnerability allows any host capable of reaching TCP/8080 to access endpoints such as /health, /file/, and /archive/. Conseq...

EUVD-2026-90085

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-46711 Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-46711 Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-55176: Incorrect Authorization

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth and authenticateWorkspaceHttp — accept the global CONTAINERSHAREDSECRET as a bearer token without verifying which...

PT-2026-103462

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

PT-2026-103463

Name of the Vulnerable Software and Affected Versions Soft Machine versions 0.2.247 and earlier Description Two authentication helpers in the /app/server.js endpoint, specifically verifyContainerAuth and authenticateWorkspaceHttp, accept the global CONTAINER SHARED SECRET as a bearer token withou...

CVE-2026-46711: Missing Authentication for Critical Function

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/ , /archive/ without any authentication or origin check. Any...