CVE-2026-55176

Name of the Vulnerable Software and Affected Versions Soft Machine versions 0.2.247 and earlier

Description Two authentication helpers in the /app/server.js endpoint, specifically verifyContainerAuth() and authenticateWorkspaceHttp(), accept the global CONTAINER SHARED SECRET as a bearer token without verifying the workspace membership of the caller. Because this secret is identical across every container in the Fly app and is accessible from the user-facing process environment within each workspace, any tenant can use it to authenticate to the workspace API of any other tenant. This allows for cross-workspace read, write, and destructive-restore operations. While the workspaceTokenMatches function protects the standard per-workspace token path, the shared-secret bearer path bypasses this check entirely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.