Paperclip Patches Unauthenticated Command Execution Flaws
Paperclip disclosed and patched a critical unauthenticated remote-code-execution flaw in April 2026, months before the issue received renewed coverage on August 5. The vendor's advisory says CVE-2026-41679 affects network-accessible default authenticated deployments before version 2026.416.0 and can be exploited through six API calls without credentials or user interaction.
Paperclip disclosed and patched a critical unauthenticated remote-code-execution vulnerability in April 2026. The issue received renewed attention on August 5 as reporting examined a broader set of authorization and local-deployment weaknesses in the AI-agent platform.
The vendor's GitHub advisory says CVE-2026-41679 affects network-accessible Paperclip instances running in authenticated mode with the default configuration. Versions before 2026.416.0 allow an unauthenticated attacker to gain full remote code execution through six API calls, without credentials or user interaction. The advisory assigns a CVSS 3.1 score of 10.0.
What the exploit crosses
The reported chain turns a registration and authorization workflow into control of the Paperclip server. CSO Online, citing Oasis Security, reports that an attacker could self-register, approve an attacker-controlled command-line authorization request and retain broad API access. The report also describes improperly protected endpoints and a DNS-rebinding issue affecting locally deployed instances.
RAXE AI's disclosure places the RCE within a wider cluster of tenant-boundary and agent-runtime findings. It recommends upgrading all @paperclipai/* packages together to 2026.416.0. That stable patch boundary is also recorded by NVD.
Patch guidance and public exploit code
Paperclip's advisory lists paperclipai and @paperclipai/server versions before 2026.416.0 as affected. NVD published its CVE entry on April 22 and records GitHub as the source.
Rapid7 has published a Metasploit module for the six-call RCE chain. Its module page refers to versions before 2026.410.0, but the vendor advisory and NVD identify 2026.416.0 as the patched boundary. Operators should follow the vendor's current advisory and verify that all related packages were upgraded together.
The practical lesson extends beyond Paperclip. An agent control plane can become a host-execution surface when configuration values reach shell commands or privileged tools. Teams running agent orchestration software should inventory externally reachable management APIs, disable unnecessary self-registration, review CLI authorization flows and separate browser-reachable local services from privileged execution paths.
Key Points
- 1Paperclip's April advisory says CVE-2026-41679 enables unauthenticated remote code execution through six API calls on default network-accessible authenticated deployments before 2026.416.0.
- 2NVD records 2026.416.0 as the fixed boundary, while a Rapid7 Metasploit page retains an earlier 2026.410.0 reference.
- 3Agent-platform operators should treat registration, management APIs, tenant authorization and host command execution as separate security boundaries.
Scoring Rationale
The vendor rates the unauthenticated RCE critical, it affects default network-accessible deployments, and public Metasploit code lowers the operational barrier to exploitation. The event is an April disclosure receiving renewed August coverage, not a newly issued patch.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
