Paperclip Patches Unauthenticated Command Execution Flaws
On August 5, 2026, Paperclip was reported to have patched three security flaws that could expose data and enable unauthenticated command execution across authenticated and locally deployed instances. NVD identifies CVE-2026-41679 as an unauthenticated remote-code-execution issue affecting network-accessible default authenticated deployments before version 2026.416.0, while CSO Online reports fixes in versions 2026.416.0 and 0.3.1.
Paperclip has released patches for three vulnerabilities that security researchers said can expose data, bypass authorization controls, and enable unauthenticated command execution in different deployment modes of the AI-agent platform.
The most severe issue, CVE-2026-41679, affects network-accessible Paperclip instances running in authenticated mode with the default configuration. The National Vulnerability Database states that versions before 2026.416.0 allow an unauthenticated attacker to obtain full remote code execution through a chain of six API calls, requiring neither credentials nor user interaction. The GitHub CNA vector recorded by NVD is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
CSO Online, citing research from Oasis Security, reports that the attack path could begin with self-registration, followed by approval of an attacker-controlled command-line authorization request. The report describes the resulting access as persistent board-level API access. CSO also reports improperly protected API endpoints and a DNS-rebinding issue that could enable drive-by remote code execution against locally deployed instances.
Affected deployments and fixes
NVD describes Paperclip as a Node.js server and React interface for orchestrating teams of AI agents. Its advisory lists both the paperclipai package and @paperclipai/server as affected up to, but excluding, version 2026.416.0.
According to CSO Online, the disclosed issues are patched in versions 2026.416.0 and 0.3.1. RAXE AI's advisory recommends upgrading all four @paperclipai/* packages together to 2026.416.0, and notes that an earlier reference to version 2026.410.0 did not correspond to a stable npm release. That distinction matters because Rapid7's Metasploit module page still describes the vulnerability as affecting versions before 2026.410.0, whereas NVD identifies 2026.416.0 as the fixed boundary.
Rapid7 has published a Metasploit module for CVE-2026-41679 and labels it "excellent," with repeatable-session reliability. The existence of a public exploitation module increases the practical urgency of identifying externally reachable, unpatched instances.
Implications for agent control planes
The reported flaws concentrate on the control plane rather than an individual model's behavior. NVD classifies CVE-2026-41679 under improper authentication, missing authorization, and insecure default initialization. RAXE AI separately characterizes the broader advisory cluster as a failure to extend authorization checks across tenant boundaries, alongside server-side execution of agent-provided configuration fields.
For teams operating comparable agent orchestration systems, this incident illustrates a recurring security boundary: an agent configuration interface can become a host-execution interface when configuration values are passed to shell commands or privileged tools. Publicly exposed management APIs, self-service registration, CLI authorization flows, and local web interfaces reachable through browser-based attacks are therefore distinct surfaces that require separate access-control and network-exposure reviews.
Organizations using Paperclip should inventory deployed package versions, update to the vendor-advised patched releases, and verify that agent-management endpoints are not unnecessarily reachable from untrusted networks.
Key Points
- 1CVE-2026-41679 enables unauthenticated remote code execution through six API calls on default network-accessible authenticated Paperclip deployments before 2026.416.0.
- 2Public Metasploit availability raises remediation priority because a repeatable exploit module lowers the operational barrier to exploiting exposed instances.
- 3Comparable agent platforms need separate controls for registration, management APIs, tenant authorization, browser-reachable local services, and host command execution.
Scoring Rationale
This is a critical remote-code-execution vulnerability in an AI-agent orchestration control plane, with affected default network-accessible deployments and a public Metasploit module. It is especially relevant to practitioners operating self-hosted agent platforms.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
