Three Paperclip Vulnerabilities Allow Command Execution via Malicious Agent Import

Researchers at Oasis Security have disclosed three vulnerabilities in Paperclip — an open-source “control panel” for teams of AI agents. The common thread tying the findings together is simple, and all the more unpleasant for it: an agent's configuration is effectively executable input. The adapter built into Paperclip runs a specified command as a child process of the server — a legitimate feature, but the vulnerabilities changed who can reach it and whose configuration the server trusts.

The self-approved key

The most serious scenario — CVE-2026-41679 (CVSS 10.0) — requires neither an account nor any action from the victim. It applies to networked installations running in authentication mode with default registration settings. The attacker registers without an invitation or a verified email, then creates and approves their own CLI authorization request, obtaining a long-lived board-level key. Next they import a .paperclip.yaml bundle describing a new “company” and an agent with a command to run: the new-company import route mistakenly accepted board-level access instead of instance administrator rights. The import also made the attacker a member of the company, and the launch passed the normal check. The command executed with the privileges of the server process.

Rapid7 has already released a Metasploit module that automates the chain of six requests. No exploitation “in the wild” had been recorded as of August 5, 2026, but the NVD flags the vulnerability as automatable with a confirmed PoC.

The browser that peeked into localhost

The second path — GHSA-x8hx-rhr2-9rf7 (CVSS 9.6) — works in the default local_trusted mode, where Paperclip listens on the loopback interface and has historically treated any request that reached it as an administrator request. In other words, network location was equated with identity. Through a DNS rebinding attack, a hostname under the attacker's control resolved both to the attacker's server and to 127.0.0.1: the browser first loaded a script from outside, and subsequent requests went to the local Paperclip, remaining “same-origin” as far as the browser was concerned. The page called the import API, installed a company with a process agent, and woke it up. No token or cookie was required. The PoC was confirmed on macOS with Firefox.

Unguarded routes

The third finding (GHSA-xfqj-r5qw-8g4j, CVSS 8.3) is a set of API routes that did not check access consistently. A holder of a valid launch identifier could obtain the associated data without confirming access to the company, and some of the routes exposed the agent's skill documentation, API paths, and deployment details.

What to do

The fixes went into code tagged v2026.416.0 (the same tag reports itself as version 0.3.1 inside the manifests — hence the confusion in the records). The advisory on DNS rebinding still does not specify a fixed version, and the metadata in the NVD diverges from the actual code. The safest reading for operators is to upgrade to v2026.416.0 or newer and to review their registration settings and network accessibility.

Source: The Hacker News