Soft Machine versions 0.2.247 and earlier contain an authentication flaw in server.js where the global CONTAINER_SHARED_SECRET can be supplied as a bearer token. The verification helpers do not confirm the caller’s workspace, allowing any tenant to use the same secret to authenticate against another tenant’s workspace API. This bypass grants unauthorized read, write, and destructive‑restore capabilities across workspaces, effectively enabling cross‑tenant privilege escalation and data tampering.

The affected vendor is Soft‑Machine‑io and its security component. Any instance of Soft Machine running version 0.2.247 or earlier is vulnerable. No specific product sub‑versions are listed beyond this threshold, and the vulnerability applies to the shared‑secret bearer token path used by the workspace API. Only the global security module is impacted.

With a CVSS score of 9, the vulnerability is considered critical. The EPSS score is not available, but the lack of a publicly known patch and the ability for any tenant’s shell to acquire the shared secret make exploitation plausible. Because the shared secret is propagated to all containers and exposed in the user‑facing process environment, an attacker with tenant access can trivially construct a request to the API using the bearer token, bypassing per‑workspace token checks. The vulnerability is not yet listed in CISA’s KEV catalog.