Threat reportVulnerabilityTL-2026-1892
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
Paperclip AI Flaws Let Attackers Run Host Commands via (TL-2026-1892), also tracked as RAXE-2026-054, is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-05 and last reviewed 2026-08-06. It has no confirmed attribution, affects PaperclipAI Paperclip Server, references 1 CVE (CVE-2026-41679), maps to 6 MITRE ATT&CK techniques (T1059, T1071, T1082), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1892
- Threat ID
- TL-2026-1892
- Also known as
- RAXE-2026-054
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, artificial-intelligence, startups, devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
- Updates
- 2026-08-06 · revalidated 1× · latest source
Malware and tooling in Paperclip AI Flaws Let Attackers Run Host Commands via
Malware and tooling: Rapid7, cURL, metasploit
How Paperclip AI Flaws Let Attackers Run Host Commands via works
Three critical vulnerabilities disclosed in Paperclip, an open-source AI agent control plane, allow unauthenticated remote code execution, DNS-rebinding drive-by attacks, and unauthorized API access. CVE-2026-41679 (CVSS 10.0) chains open registration, CLI auth self-approval, and an import authorization bypass to execute arbitrary OS commands via malicious agent bundles with no credentials required. GHSA-x8hx-rhr2-9rf7 (CVSS 9.6) exploits DNS rebinding against local_trusted deployments for drive-by RCE. GHSA-xfqj-r5qw-8g4j (CVSS 8.3) exposes multiple API endpoints without authentication. Discovered by Oasis Security; fix available in v2026.416.0 (also labeled 0.3.1). No in-the-wild exploitation reported as of August 5, 2026.
Paperclip is an open-source Node.js/React orchestration platform described as a 'control plane' for managing teams of AI agents to run a business. It supports multiple agent adapters including a process adapter that executes arbitrary shell commands on the host via Node.js child_process.spawn() with shell:true and zero sandboxing. Oasis Security disclosed three vulnerabilities in Paperclip, all stemming from the same root cause: the platform treats agent configuration as inert data rather than executable input, and it trusted a credential, a route, or a network location without applying the authorization check the later operation required.
**CVE-2026-41679 (CVSS 10.0, CRITICAL) — Unauthenticated Remote Code Execution**
The attack chains four independent flaws: (1) open registration is enabled by default with email verification hardcoded off, allowing anyone to sign up; (2) the POST /api/cli-auth/challenges endpoint creates a CLI authentication challenge with no actor check, and the approval logic fails to verify the approver is not the challenge creator, enabling self-approval of a persistent board API key; (3) the POST /api/companies/import endpoint lacks the assertInstanceAdmin check for new_company mode, unlike the direct company creation endpoint; (4) the process adapter passes user-supplied command and args directly to spawn() with shell:true and no input validation, sandboxing, or character filtering. The full six-request chain is fully automated. Rapid7 shipped a Metasploit module (exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679, ExcellentRanking) in June 2026 automating the attack. CISA-ADP SSVC analysis marks exploitation as 'poc confirmed', automatable 'yes', and technical impact 'total'. Affected versions: < 2026.410.0 (or < 2026.416.0 per some sources).
**GHSA-x8hx-rhr2-9rf7 (CVSS 9.6, CRITICAL) — DNS Rebinding / Drive-by RCE**
Paperclip's default local_trusted mode binds to loopback and treats every request as an implicit instance administrator — no token, session, or authentication is required. The hostname guard (private-hostname-guard.ts) only activates in authenticated+private mode, not local_trusted. An attacker registers a domain with two DNS A records (both TTL=0): one pointing to the attacker's server IP, one pointing to 127.0.0.1. The victim visits the attacker's page; the browser connects to the attacker's IP first. The attacker serves a malicious HTML page with exploit JavaScript, then shuts down their server. The browser retries the same hostname, now resolving to 127.0.0.1 — the Paperclip local instance. The browser sees a single origin throughout, bypassing CORS. The JS calls POST /api/companies/import to import a malicious agent bundle with a process adapter, then POST /api/agents/:id/wakeup to execute arbitrary commands on the victim's machine with Paperclip server OS privileges. Verified on macOS with Firefox. Affected versions: < 0.3.1.
**GHSA-xfqj-r5qw-8g4j (CVSS 8.3, HIGH) — Missing API Authentication**
Multiple API endpoints in authenticated mode either lack authentication entirely or fail to enforce tenant-level authorization. The GET /api/health endpoint leaks deployment mode, exposure setting, auth status, bootstrap status, version, and feature flags (reconnaissance data). The GET /api/heartbeat-runs/:runId/issues endpoint returns issue data for a heartbeat run without calling assertCompanyAccess, unlike every other endpoint in the same file. The GET /api/skills/index, /api/skills/:skillName endpoints expose agent instructions, system prompts, internal API endpoints, parameters, and authentication conventions. The POST /api/cli-auth/challenges endpoint creates a CLI auth challenge with no actor check, forming part of the credential-generation chain used in CVE-2026-41679. The root design flaw: unauthenticated requests pass through middleware with a 'no actor' identity, leaving each route to remember its own assertion. Affected versions: < 0.3.1 (patched in 2026.416.0).
**Impact Potential:** Full filesystem access, database access, source code repositories, locally stored credentials, secrets available to agent processes, and internal services reachable from the host. In local_trusted mode, the attack compromises developer machines with no credentials needed. CISA-ADP flags total technical impact.
**Patch Status:** Paperclip v2026.416.0 (also labeled 0.3.1) contains all fixes: hostname guard enabled for local_trusted mode, instance-administrator requirement for new-company imports, blocks on process/HTTP adapters from restricted import paths, JWT secret handling hardening, Bearer token redaction in logs, and dependency security updates. Eight new database migrations (0049-0056) are included. The GHSA-68qg-g8mg-6pr7 advisory fix was applied via PR #3315.
MITRE ATT&CK techniques used in TL-2026-1892
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505 Server Software Component
Reconnaissance
Affected products and versions in Paperclip AI Flaws Let Attackers Run Host Commands via
- PaperclipAI — Paperclip Server
Vulnerable versions: < 2026.410.0; < 0.3.1
Fixed in: 2026.416.0; 0.3.1 - PaperclipAI — @paperclipai/server (npm)
Vulnerable versions: < 2026.410.0
Fixed in: 2026.416.0
Remediation for Paperclip AI Flaws Let Attackers Run Host Commands via
Patches
- Apply Paperclip v2026.416.0 (or 0.3.1 for local_trusted deployments) which contains all fixes for these three advisories
Immediate actions
- Upgrade Paperclip to v2026.416.0 (or 0.3.1 for local_trusted deployments) immediately
- Restrict network access to Paperclip instances behind VPN or firewall
- Disable open registration by setting PAPERCLIP_AUTH_DISABLE_SIGN_UP=true
- Enable email verification (requireEmailVerification: true)
Workarounds
- If immediate upgrade is not possible, disable open registration and require email verification in configuration
- For local_trusted mode, manually apply Host header validation with an allowlist of localhost, 127.0.0.1, [::1]
- Block unauthenticated access to /api/* routes at the reverse proxy level
- Restrict the process adapter to only allow pre-approved commands or disable it entirely
Longer-term hardening
- Treat agent configuration files as executable input, not inert data — apply code review, scanning, and signing to all agent bundles
- Implement zero-trust authorization model: every API route must explicitly assert the required access level
- Monitor Paperclip API logs for unauthorized import operations, agent creation, and wakeup calls
- Deploy Host header validation with an allowlist (localhost, 127.0.0.1, [::1]) for loopback-bound deployments
- Audit all existing agent configurations for unauthorized process adapter usage or suspicious commands
- Implement network segmentation isolating AI orchestration infrastructure from other internal services
- Deploy WAF rules to detect malicious import API calls and DNS rebinding patterns
CVEs associated with Paperclip AI Flaws Let Attackers Run Host Commands via
Weaknesses (CWE) in Paperclip AI Flaws Let Attackers Run Host Commands via
Timeline of Paperclip AI Flaws Let Attackers Run Host Commands via
- CVE-2026-41679 (GHSA-68qg-g8mg-6pr7) first disclosed and reported to Paperclip by Oasis Security researcher sagilayani
- GHSA-xfqj-r5qw-8g4j published: Paperclip unauthenticated API endpoints (CVSS 8.3, HIGH) — health endpoint, CLI auth challenge, skill documentation, and heartbeat run issues exposed without authentication
- NVD publishes CVE-2026-41679 with CVSS 10.0 CRITICAL score; CISA-ADP SSVC analysis confirms proof-of-concept exploitation, automatable, total technical impact
- NIST completes initial NVD analysis, adding CPE configurations for the paperclipai and @paperclipai/server npm packages.
- Rapid7 Metasploit PR #21547 merged: module exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679 (ExcellentRanking) by h00die-gr3y fully automates the six-request attack chain against Paperclip authenticated deployments
- GHSA-x8hx-rhr2-9rf7 published: DNS rebinding vulnerability in Paperclip local_trusted mode (CVSS 9.6, CRITICAL) — drive-by RCE on developer machines via dual-DNS A records with TTL=0 switching between attacker server and 127.0.0.1
- RAXE Labs publishes RAXE-2026-054 consolidating 11 GitHub-reviewed advisories covering 8 distinct failure primitives (4 rated critical at CVSS 9.8-10.0) in Paperclip's agent runtime and tenant boundary enforcement
- Oasis Security public disclosure via The Hacker News and CSO Online articles; Paperclip v2026.416.0 (also labeled 0.3.1) available with all fixes including hostname guard, import authorization, and restricted adapter configurations
- SecurityWeek publishes follow-up analysis of the flaw, confirming Paperclip v2026.416.0 as the patched version.
Update history for TL-2026-1892
- 2026-08-06 — CVE-2026-41679 — Critical Paperclip AI Management Platform Authorization Bypass Leading to Unauthenticated RCE: What changed No escalation: severity remains CRITICAL, exploitability remains POC_PUBLIC, status remains ACTIVE, CVSS unchanged at 10.0. The newer report corroborates the existing record and adds source-code-level precision (exact vulnerabl
Sources cited for Paperclip AI Flaws Let Attackers Run Host Commands via
- Paperclip AI Flaws Let Attackers Run Host Commands
- Critical Paperclip Bugs Expose AI Agent Trust Failures
- GHSA-68qg-g8mg-6pr7 — Paperclip Unauthenticated RCE
- GHSA-x8hx-rhr2-9rf7 — DNS Rebinding RCE in Paperclip
- GHSA-xfqj-r5qw-8g4j — Paperclip Unauthenticated API Endpoints
- NVD — CVE-2026-41679
- Rapid7 Metasploit Module — paperclipai_unauth_rce_cve_2026_41679
- Metasploit Framework PR #21547 — Paperclip RCE Module
- Paperclip v2026.416.0 Release Notes
- Paperclip Changelog v2026.416.0
- RAXE-2026-054 — Paperclip Agent Runtime & Tenant Boundary Collapse
- OSV — CVE-2026-41679
- AttackerKB — CVE-2026-41679
- Paperclip GitHub Repository
Detection coverage for TL-2026-1892
As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1892 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.