Soft Machine versions 0.2.247 and prior have a missing authentication vulnerability (CWE-306) in their workspace HTTP service. The service listens on 0.0.0.0:8080 and exposes endpoints (/health, /file/<path>, /archive/<dir>) without authentication or origin checks. This allows any host able to reach the TCP port to read arbitrary files under the workspace root and download entire project trees as tar archives. Since all workspaces share a private 6PN network and resolve peer addresses via an unauthenticated internal TXT record, any other workspace in the same Fly app/org can access these endpoints unauthenticated, violating the trust boundary between workspace owners and others. No official patches or fixes are available at the time of publication.

An attacker with network access to the workspace's TCP port 8080 can read arbitrary files and download entire project directories without authentication. Furthermore, any other workspace within the same Fly app or organization can exploit this vulnerability due to shared private networking and unauthenticated internal DNS resolution. This leads to a complete compromise of confidentiality and integrity of workspace data, with limited availability impact.

At the time of publication, no official patches or fixes are available. Users should restrict network access to the workspace HTTP service on port 8080 to trusted hosts only and consider isolating workspaces to prevent unauthorized internal access. Monitor vendor advisories for updates or patches addressing this issue.