Critical Paperclip AI Flaw Enabled Admin Access and Server Code Execution

Paperclip, an open-source control plane for AI agent teams, patched a critical authorization bypass tracked as CVE-2026-41679 that could let a remote attacker self-register on exposed instances, obtain board-level API access, and execute arbitrary commands on the host running the service. The issue affected network-accessible deployments using Paperclip’s default authenticated-mode configuration, where missing authorization checks allowed an attacker to create and approve a CLI challenge, gain a persistent credential, and abuse a company import path that should have been restricted to instance administrators. By importing a crafted .paperclip.yaml file, an attacker could define an agent and command that would be executed by a host-level adapter with the permissions of the Paperclip server process.

Paperclip also fixed two additional flaws reported by Oasis Security: GHSA-x8hx-rhr2-9rf7, a DNS rebinding issue in default local_trusted mode that could enable local command execution on developer machines, and GHSA-xfqj-r5qw-8g4j, which exposed issue data, skill documentation, and deployment details through missing authentication and authorization checks on several API routes. The fixes were released in source tag v2026.416.0, and operators were advised to upgrade to that version or later. Public exploit code has increased risk, including a Rapid7 Metasploit module for CVE-2026-41679, while reporting cited proof-of-concept exploitation but no confirmed active exploitation in the wild at the time of publication.