CVE-2026-46711

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.

• CWE-306

• https://github.com/Soft-Machine-io/security/security/advisories/GHSA-h6g6-qr45-qmrr
• https://github.com/Soft-Machine-io/security/security/advisories/GHSA-h6g6-qr45-qmrr

Published

Sep 30, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46703Boxlite is a sandbox service that allows users to create lig…9.6
• CVE-2026-46705Russh is a Rust SSH client & server library. From version 0.…5.3
• CVE-2026-46708EspoCRM is an open source customer relationship management a…4.3
• CVE-2026-46709Tabby (formerly Terminus) is a highly configurable terminal …7.8
• CVE-2026-4671justhtml before 1.18.0 contains multiple low-severity denial…7.5
• CVE-2026-46710Notepad++ is a free and open-source source code editor. From…7.8
• CVE-2026-46712Misskey is an open source, federated social media platform. …2.3
• CVE-2026-46713Misskey is an open source, federated social media platform. …9.2
• CVE-2026-46714Misskey is an open source, federated social media platform. …5.1
• CVE-2026-46715Flask-Security-Too allows users to add security features to …5.3
• CVE-2026-46716Nezha Monitoring is a self-hostable, lightweight, servers an…9.9
• CVE-2026-46717Nezha Monitoring is a self-hostable, lightweight, servers an…7.7