Loading story…
Paperclip, an open-source control plane for AI agent teams, patched a critical authorization bypass tracked as CVE-2026-41679 that could let a remote attacker self-register on exposed instances, obtain board-level API access, and execute arbitrary commands on the host running the service. The issue affected network-accessible deployments using Paperclip’s default authenticated-mode configuration, where missing authorization checks allowed an attacker to create and approve a CLI challenge, gain a persistent credential, and abuse a company import path that should have been restricted to instance administrators. By importing a crafted .paperclip.yaml file, an attacker could define an agent and command that would be executed by a host-level adapter with the permissions of the Paperclip server process.
Paperclip also fixed two additional flaws reported by Oasis Security: GHSA-x8hx-rhr2-9rf7, a DNS rebinding issue in default local_trusted mode that could enable local command execution on developer machines, and GHSA-xfqj-r5qw-8g4j, which exposed issue data, skill documentation, and deployment details through missing authentication and authorization checks on several API routes. The fixes were released in source tag v2026.416.0, and operators were advised to upgrade to that version or later. Public exploit code has increased risk, including a Rapid7 Metasploit module for CVE-2026-41679, while reporting cited proof-of-concept exploitation but no confirmed active exploitation in the wild at the time of publication.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Articles published in early August 2026 disclosed technical details of CVE-2026-41679, a critical Paperclip flaw allowing self-registration, board-level API access, malicious agent import, and server-side command execution. The reporting also described a DNS rebinding-based local command-execution path and an API authorization flaw that could expose sensitive data.
Noma Security published a blog post describing 'GitLost,' a technique that allegedly tricked GitHub’s AI agent into leaking contents from private repositories. The post appears to introduce technical details of a distinct security issue affecting GitHub-related AI-assisted workflows.
Rapid7 released a public Metasploit module that automates the six-request attack chain for CVE-2026-41679 in Paperclip. The module provided public proof-of-concept exploitation capability for the critical authorization bypass and command-execution flaw.
Paperclip addressed CVE-2026-41679 by requiring stronger authorization for imports, including instance-administrator access for new-company imports, and applied the same checks to import preview and execution. The same release also added hostname validation protections against DNS rebinding and fixed API routes with missing authentication or authorization checks that could expose sensitive data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcethehackernews.com
Open sourcenoma.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution flaw, **`CVE-2026-61447`**, was disclosed in the PraisonAI AI agent framework, affecting versions before **`1.6.78`**. The vulnerability lies in **`CodeAgent._execute_python()`**, which executes LLM-generated Python without AST validation, import restrictions, or sandbox enforcement, allowing attackers to use prompt injection to make the agent run arbitrary code on the host. The issue received the maximum severity rating of **CVSS 10.0** under both v3.1 and v4.0. Successful exploitation can result in full host compromise and theft of sensitive data, including API keys, cloud credentials, database passwords, and other environment secrets, with potential pivoting into connected services. PraisonAI **`1.6.78`** fixes the issue, and defenders are being urged to upgrade immediately, reduce network exposure, rotate potentially exposed secrets, and monitor for anomalous outbound connections; no confirmed in-the-wild exploitation had been reported at disclosure time.
Jul 11, 2026
Security agencies warned that multiple vulnerabilities in **PaperCut MF** and **PaperCut NG** can expose organizations to serious compromise, including the actively exploited flaw **`CVE-2023-27350`**. CISA previously reported that malicious actors were exploiting the vulnerability in the wild, allowing unauthenticated attackers to gain remote access to vulnerable PaperCut application servers and potentially execute code, making internet-exposed print management systems a high-risk target. A later security bulletin from HKCERT highlighted additional PaperCut vulnerabilities, reinforcing ongoing risk around the platform and the need for prompt remediation. Together, the advisories indicate that unpatched PaperCut deployments remain attractive entry points for attackers, with affected organizations urged to review vendor guidance, apply available updates, and assess exposed servers for signs of compromise.
Jun 29, 2026
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. **Coder Workspace Agent** patched `GHSA-QRWJ-VH9X-GW5V`, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP `307`/`308` redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions `v2.34.4`, `v2.33.10`, `v2.32.9`, and `v2.29.19 ESR`. **Coolify** disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as `dockerfile_location`, allowing RCE and secrets exposure through deployment logs, while **OpenRemote** fixed `GHSA-cgfv-jrfp-2r7v`, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials. Additional disclosures affected AI and package-management components. **Langroid** fixed a prompt-injection-driven flaw in `Neo4jChatAgent` that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version `0.65.5` with new safety controls that were also extended to `ArangoChatAgent`. **pnpm** also reported a path traversal weakness in `configDependencies` processing from `pnpm-lock.yaml`, where a malicious repository could force symlink creation outside `node_modules/.pnpm-config` even with `--ignore-scripts`, creating a filesystem write primitive within or potentially beyond the project directory.
Jul 10, 2026