# Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports

> Three critical vulnerabilities disclosed in Paperclip, an open-source AI agent control plane, allow unauthenticated remote code execution, DNS-rebinding drive-by attacks, and unauthorized API access. CVE-2026-41679 (CVSS 10.0) chains open registration, CLI auth self-approval, and an import authorization bypass to execute arbitrary OS commands via malicious agent bundles with no credentials required. GHSA-x8hx-rhr2-9rf7 (CVSS 9.6) exploits DNS rebinding against local_trusted deployments for drive-by RCE. GHSA-xfqj-r5qw-8g4j (CVSS 8.3) exposes multiple API endpoints without authentication. Discovered by Oasis Security; fix available in v2026.416.0 (also labeled 0.3.1). No in-the-wild exploitation reported as of August 5, 2026.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-06T11:33:52.843Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1892
- **ID:** TL-2026-1892
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41679

## Description

Paperclip is an open-source Node.js/React orchestration platform described as a 'control plane' for managing teams of AI agents to run a business. It supports multiple agent adapters including a process adapter that executes arbitrary shell commands on the host via Node.js child_process.spawn() with shell:true and zero sandboxing. Oasis Security disclosed three vulnerabilities in Paperclip, all stemming from the same root cause: the platform treats agent configuration as inert data rather than executable input, and it trusted a credential, a route, or a network location without applying the authorization check the later operation required.

**CVE-2026-41679 (CVSS 10.0, CRITICAL) — Unauthenticated Remote Code Execution**

The attack chains four independent flaws: (1) open registration is enabled by default with email verification hardcoded off, allowing anyone to sign up; (2) the POST /api/cli-auth/challenges endpoint creates a CLI authentication challenge with no actor check, and the approval logic fails to verify the approver is not the challenge creator, enabling self-approval of a persistent board API key; (3) the POST /api/companies/import endpoint lacks the assertInstanceAdmin check for new_company mode, unlike the direct company creation endpoint; (4) the process adapter passes user-supplied command and args directly to spawn() with shell:true and no input validation, sandboxing, or character filtering. The full six-request chain is fully automated. Rapid7 shipped a Metasploit module (exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679, ExcellentRanking) in June 2026 automating the attack. CISA-ADP SSVC analysis marks exploitation as 'poc confirmed', automatable 'yes', and technical impact 'total'. Affected versions: < 2026.410.0 (or < 2026.416.0 per some sources).

**GHSA-x8hx-rhr2-9rf7 (CVSS 9.6, CRITICAL) — DNS Rebinding / Drive-by RCE**

Paperclip's default local_trusted mode binds to loopback and treats every request as an implicit instance administrator — no token, session, or authentication is required. The hostname guard (private-hostname-guard.ts) only activates in authenticated+private mode, not local_trusted. An attacker registers a domain with two DNS A records (both TTL=0): one pointing to the attacker's server IP, one pointing to 127.0.0.1. The victim visits the attacker's page; the browser connects to the attacker's IP first. The attacker serves a malicious HTML page with exploit JavaScript, then shuts down their server. The browser retries the same hostname, now resolving to 127.0.0.1 — the Paperclip local instance. The browser sees a single origin throughout, bypassing CORS. The JS calls POST /api/companies/import to import a malicious agent bundle with a process adapter, then POST /api/agents/:id/wakeup to execute arbitrary commands on the victim's machine with Paperclip server OS privileges. Verified on macOS with Firefox. Affected versions: < 0.3.1.

**GHSA-xfqj-r5qw-8g4j (CVSS 8.3, HIGH) — Missing API Authentication**

Multiple API endpoints in authenticated mode either lack authentication entirely or fail to enforce tenant-level authorization. The GET /api/health endpoint leaks deployment mode, exposure setting, auth status, bootstrap status, version, and feature flags (reconnaissance data). The GET /api/heartbeat-runs/:runId/issues endpoint returns issue data for a heartbeat run without calling assertCompanyAccess, unlike every other endpoint in the same file. The GET /api/skills/index, /api/skills/:skillName endpoints expose agent instructions, system prompts, internal API endpoints, parameters, and authentication conventions. The POST /api/cli-auth/challenges endpoint creates a CLI auth challenge with no actor check, forming part of the credential-generation chain used in CVE-2026-41679. The root design flaw: unauthenticated requests pass through middleware with a 'no actor' identity, leaving each route to remember its own assertion. Affected versions: < 0.3.1 (patched in 2026.416.0).

**Impact Potential:** Full filesystem access, database access, source code repositories, locally stored credentials, secrets available to agent processes, and internal services reachable from the host. In local_trusted mode, the attack compromises developer machines with no credentials needed. CISA-ADP flags total technical impact.

**Patch Status:** Paperclip v2026.416.0 (also labeled 0.3.1) contains all fixes: hostname guard enabled for local_trusted mode, instance-administrator requirement for new-company imports, blocks on process/HTTP adapters from restricted import paths, JWT secret handling hardening, Bearer token redaction in logs, and dependency security updates. Eight new database migrations (0049-0056) are included. The GHSA-68qg-g8mg-6pr7 advisory fix was applied via PR #3315.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1082 System Information Discovery
- T1071 Application Layer Protocol

## Sources

- [Paperclip AI Flaws Let Attackers Run Host Commands](https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html)
- [Critical Paperclip Bugs Expose AI Agent Trust Failures](https://www.csoonline.com/article/4205630/critical-paperclip-bugs-expose-ai-agent-trust-failures.html)
- [GHSA-68qg-g8mg-6pr7 — Paperclip Unauthenticated RCE](https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7)
- [GHSA-x8hx-rhr2-9rf7 — DNS Rebinding RCE in Paperclip](https://github.com/paperclipai/paperclip/security/advisories/GHSA-x8hx-rhr2-9rf7)
- [GHSA-xfqj-r5qw-8g4j — Paperclip Unauthenticated API Endpoints](https://github.com/paperclipai/paperclip/security/advisories/GHSA-xfqj-r5qw-8g4j)
- [NVD — CVE-2026-41679](https://nvd.nist.gov/vuln/detail/CVE-2026-41679)
- [Rapid7 Metasploit Module — paperclipai_unauth_rce_cve_2026_41679](https://www.rapid7.com/db/vulnerabilities/exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679/)
- [Metasploit Framework PR #21547 — Paperclip RCE Module](https://github.com/rapid7/metasploit-framework/blob/f677044adbf64ed35e52f13821fc2c7f1e31d26c/modules/exploits/linux/http/paperclipai_unauth_rce_cve_2026_41679.rb)
- [Paperclip v2026.416.0 Release Notes](https://github.com/paperclipai/paperclip/releases/tag/v2026.416.0)
- [Paperclip Changelog v2026.416.0](https://paperclip.ing/changelog/v2026.416.0/)
- [RAXE-2026-054 — Paperclip Agent Runtime & Tenant Boundary Collapse](https://raxe.ai/labs/advisories/RAXE-2026-054)
- [OSV — CVE-2026-41679](https://osv.dev/vulnerability/CVE-2026-41679)
- [AttackerKB — CVE-2026-41679](https://attackerkb.com/topics/86rSV7hsXi/cve-2026-41679)
- [Paperclip GitHub Repository](https://github.com/paperclipai/paperclip)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1892