Two critical security vulnerabilities in Paperclip, an open-source control plane for AI agent teams, could allow attackers to execute commands on network servers or developers' machines by importing a malicious agent and starting it. A third flaw exposed sensitive data via API routes lacking proper access checks.
The most severe issue, tracked as CVE-2026-41679 with a CVSS score of 10.0, targets network-accessible deployments using authenticated mode with default registration. It requires no pre-existing account or victim interaction. The second path, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), needs a user to open an attacker-controlled page while Paperclip runs in its default local_trusted mode.
Both attack chains end with attacker-controlled agent configuration reaching Paperclip's host execution adapter, which launches commands as child processes of the server. The execution feature is legitimate; the flaws changed who could reach it and whose configuration the server trusted. As Oasis Security noted, "Agent configuration must be treated as executable input."
For the server-side attack, Paperclip's default open-signup flow lets an attacker register without invitation or verified email. They can then self-approve a CLI challenge to obtain a durable board API credential. A flaw allowed this board-level access to create a new company via import, bypassing the instance-administrator requirement. The attacker could supply a .paperclip.yaml bundle defining a company, a process-based agent, and the command to run. Starting the agent triggered the command with server process privileges, potentially exposing application data, source repos, credentials, and internal services.
Paperclip fixed CVE-2026-41679 in v2026.416.0 by requiring instance-administrator access for new-company imports and company access for existing ones. Rapid7 shipped a Metasploit module automating the six-request attack chain in June 2026. CISA's SSVC enrichment classifies exploitation as proof-of-concept, but no in-the-wild exploitation was reported as of August 5, 2026. The flaw is not in CISA's KEV catalog.
The localhost path exploits DNS rebinding. In default local_trusted mode, Paperclip binds to loopback and treats all requests as instance administrators. Oasis demonstrated an attacker-controlled hostname resolving to both the attacker's server and 127.0.0.1. After the attacker's server stopped responding, browser requests to the same hostname reached the local Paperclip service, which accepted the Host header. The page then imported a company with a process agent and invoked its wakeup endpoint, running commands with developer privileges. No token or credential was needed. The proof of concept was verified on macOS with Firefox.
The fix in v2026.416.0 adds hostname validation for private deployments, rejecting rebound requests before they reach the API.
The third advisory, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), covers API routes in authenticated mode that failed to reject unauthenticated or cross-company requests. A valid heartbeat-run identifier could retrieve associated issue data without company access. Other routes exposed skill documentation, API paths, health information, and feature flags. The unauthenticated CLI challenge route also contributed to the CVE-2026-41679 chain. Paperclip added authentication to skill routes, company-access checks, and reduced health responses.
Version tracking is confusing: the GitHub security release is v2026.416.0, but the server and CLI manifests inside that tag report version 0.3.1. The DNS-rebinding advisory still lists no patched version, though the tagged code contains the fix. Operators should upgrade to v2026.416.0 or later and review registration and deployment exposure settings.
Source: The Hackers News