Soft Machine CVE-2026-46711

Exploitation requires network position on the same Fly private 6PN mesh as the target - in practice, controlling another sm-ws-* Fly Machine in the same Fly app/org - because the workspace HTTP service binds 0.0.0.0:8080 but is only routable to 6PN peers, not the public internet. Given that position, no authentication, credentials, origin check, or user interaction is needed: the /file/<path> and /archive/<dir> endpoints serve arbitrary files under /workspace to any peer, and peers are discoverable via the unauthenticated _instances.internal TXT record. Limiting factors: the attacker must already be a tenant/workspace on the shared org (not remotely anonymous over the internet), and affected versions are 0.2.247 and prior. Single-tenant or network-isolated deployments are not reachable by outside parties.

This is a genuine cross-tenant data-exposure flaw, but its reachability is bounded by network topology rather than open to the internet. The vendor CVSS vector is AV:A (adjacent), not AV:N - exploitation requires being a peer on the same Fly private 6PN network, i.e. controlling another sm-ws-* machine in the same Fly app/org. Within that adjacency the flaw is trivial: AC:L, no authentication on the /file and /archive endpoints (CWE-306), and any peer can enumerate others via the unauthenticated _instances.internal TXT record. There is no EPSS, no KEV listing, and no public POC, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor score of 8.3 is driven largely by S:C plus I:H/A:L, which look inflated: the described endpoints (/health, /file/<path>, /archive/<dir>) are read-only file-disclosure paths, so the real impact is confidentiality (C:H) with integrity/availability effects not substantiated by the description - I assess I:N/A:N, yielding roughly 6.8. Also note the vendor set PR:H while the described precondition is merely owning any workspace on the shared org, which is closer to PR:L. Net: a real and easily-triggered cross-tenant read for anyone already tenant on a shared Soft Machine deployment, but not internet-exposed and not (yet) known-exploited. Priority is elevated for multi-tenant operators of this platform, low for everyone else. No patch is available at publication, which raises urgency for affected operators.

An attacker signs up for or already controls one workspace (sm-ws-*) on a shared Soft Machine Fly app, then queries the unauthenticated _instances.internal TXT record to enumerate all peer workspace addresses on the 6PN private network. They connect to TCP/8080 on a victim's workspace and call /archive/<dir> or /file/<path> to download another tenant's entire /workspace project tree, including source code and secrets, with no authentication. No public exploit code is known, but the technique requires only standard HTTP requests.