Full research report
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
Executive assessment
The most serious confirmed issue is CVE-2026-41679: an attacker beginning without credentials could exploit permissive registration and credential approval, cross an import authorization boundary, and cause Paperclip's legitimate process adapter to execute imported configuration. The separate local_trusted flaw reached a similar result through a victim's browser and DNS rebinding, while the third advisory exposed sensitive API data and reduced reconnaissance barriers. Version 2026.416.0 clearly fixes the CVE and documented route authorization failures, but the DNS advisory's lack of a patched version conflicts with Oasis's broader remediation statement. Public exploit tooling materially increases risk, although neither CISA's catalogue nor the other reviewed authorities confirmed exploitation in the wild.
What happened
Paperclip disclosed three related security failures affecting its orchestration software: CVE-2026-41679 enabled unauthenticated remote command execution against exposed authenticated-mode deployments, a separate DNS-rebinding flaw targeted local_trusted installations, and missing route checks exposed sensitive data and control information. Paperclip released version 2026.416.0 on 16 April 2026 with documented authorization hardening; Rapid7 merged a Metasploit module on 11 June and shipped it later that month, before broader reporting on 5 August.
Affected scope
CVE-2026-41679 affects @paperclipai/server and paperclipai releases before 2026.416.0 when authenticated mode is network-accessible and default open registration is retained. GHSA-xfqj-r5qw-8g4j covers unauthenticated API access and identifies 2026.416.0 as patched. GHSA-x8hx-rhr2-9rf7 concerns default local_trusted installations reachable through a victim's browser, but its version metadata lists releases before 0.3.1 as affected and does not identify a patched version.
Technical assessment
For CVE-2026-41679, a new user could obtain a durable board credential and reach a company-import operation whose authorization requirement was weaker than equivalent direct company creation. An imported worker definition could select Paperclip's legitimate process adapter, and starting that worker caused attacker-controlled configuration to execute with the operating-system privileges of the Paperclip service. The local path instead relied on DNS rebinding, absent hostname validation and local_trusted mode treating requests reaching loopback as administrator-authorised; the third finding arose from API routes lacking authentication or company-scoping checks.
Recommended defensive actions
- Patch Paperclip to version 2026.416.0 or later to remediate CVE-2026-41679 and the documented API authorization failures.
- Disable open registration on authenticated deployments unless it is explicitly required, and restrict Paperclip network exposure to trusted administrative networks.
- Disable local_trusted mode when browsing untrusted sites or repositories until Paperclip identifies an unambiguous fixed release for GHSA-x8hx-rhr2-9rf7; use authenticated mode and enforce hostname validation instead.
- Audit Paperclip records for rapid account creation, self-approved command-line credentials, unexpected company imports, worker wake-ups and unusual child processes.
- Review imported configuration as executable code and restrict the credentials, filesystem paths and network services available to the Paperclip service account.
- Rotate credentials accessible to the Paperclip process and investigate affected hosts if unexplained imports or process launches are found.
Uncertainties and evidence gaps
- No authoritative source reviewed confirmed exploitation in the wild; public exploit availability and a critical severity score do not establish active compromise.
- The DNS-rebinding advisory lists no patched version, while Oasis states broadly that the findings were fixed in 2026.416.0; operators should seek explicit vendor confirmation for that path.
- Public records do not establish how many vulnerable Paperclip deployments are internet-accessible or whether any organisations were compromised.
- Rapid7's pull-request description refers to releases before 2026.410.0, whereas the vendor advisory and NVD identify releases before 2026.416.0; the vendor and NVD range is stronger.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed in-the-wild exploitation as of 6 August 2026; public proof-of-concept material exists for both command-execution paths, and Rapid7 has released a Metasploit module for CVE-2026-41679.
The investigation first separated the reported network vulnerability from the localhost and information-disclosure findings. Primary Paperclip advisories and the release record confirmed the affected conditions, execution boundary and principal fix, while NVD independently corroborated CVE-2026-41679. Rapid7 established public exploit availability, but a live CISA catalogue check and the reviewed reporting provided no confirmation of in-the-wild exploitation.
- What precise event and claims did the supplied article describe?Read the supplied 5 August 2026 report and separated the network command-execution chain from the localhost and unauthenticated-route findings.thehackernews.com ↗
The story concerned three distinct flaws, only one of which carried CVE-2026-41679, and reported public Metasploit availability without known in-the-wild exploitation.
why This prevented the CVE's exploitation status and affected deployment mode from being incorrectly applied to every reported flaw.
- Does the vendor record confirm CVE-2026-41679 and its affected range?Read the Paperclip security advisory for the import authorization bypass.github.com ↗
The advisory assigns CVE-2026-41679, rates it critical, identifies releases before 2026.416.0 as affected and describes unauthenticated command execution in network-accessible authenticated mode.
why This primary record established the vulnerability, operational hook, affected conditions and fixed version.
- Is the localhost path part of CVE-2026-41679 or a separate weakness?Read the Paperclip DNS-rebinding advisory.github.com ↗
The browser-assisted local_trusted attack has no known CVE, requires the victim to visit attacker-controlled content and lists no patched version.
why This demonstrated that the localhost path must not be described as unauthenticated network exploitation of CVE-2026-41679 and exposed a remediation uncertainty.
- What was the third reported security issue?Read the advisory covering unauthenticated API access.github.com ↗
Several authenticated-mode routes lacked authentication or company-scoping checks, exposing issue data, operational instructions and deployment information; the advisory identifies 2026.416.0 as patched.
why This confirmed a separate information-exposure and reconnaissance issue rather than another independently established command-execution CVE.
- What did Paperclip actually record as fixed in version 2026.416.0?Reviewed the official release notes and their security section.github.com ↗
The 16 April release documents authorization hardening for import, approval, activity and heartbeat routes and instructs all deployments to upgrade.
why The release provides direct support for the import and API-route fixes, but does not expressly name the DNS-rebinding advisory.
- Does a government vulnerability record independently corroborate CVE-2026-41679?Read the National Vulnerability Database entry.nvd.nist.gov ↗
NVD identifies Paperclip before 2026.416.0 as vulnerable to unauthenticated remote command execution and carries GitHub's critical 10.0 CVSS assessment.
why This supplied independent confirmation of the CVE, affected range and impact while not proving active exploitation.
- Is operational public exploit tooling available?Reviewed Rapid7's June 2026 Metasploit Pro release notes.docs.rapid7.com ↗
Rapid7 states that the release added an exploit module for CVE-2026-41679 targeting default authenticated-mode Paperclip deployments.
why This moves the assessment from a privately claimed proof of concept to confirmed public exploit-tool availability.
- Was the Rapid7 module merely proposed or accepted?Opened the associated Metasploit Framework pull request.github.com ↗
The module was merged on 11 June 2026 after documented testing, although its introductory affected-version wording differs from the vendor advisory.
why The merge confirms availability while the version discrepancy supports using the vendor and NVD range for defensive decisions.
- How did the original researchers connect the three weaknesses?Read Oasis Security's 5 August analysis.oasis.security ↗
Oasis attributes the outcomes to executable configuration crossing weak authorization and loopback trust boundaries and recommends upgrading, reviewing deployment settings and auditing configuration and execution records.
why This clarified the common security design problem and supported practical defensive actions without collapsing the distinct access requirements.
- Is CVE-2026-41679 recognised by CISA as exploited in the wild?Queried CISA's Known Exploited Vulnerabilities catalogue for the exact CVE.
The catalogue returned no matching entry on 6 August 2026.
why This supports reporting no confirmed active exploitation while recognising that absence from the catalogue cannot prove exploitation has not occurred.
Research coverage
All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 2 corroborating, 0 contextual and 1 PoC/exploit references). 54 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| Metasploit module metadataexploit_reference | ok empty0 records | PoC reference1 matched items | Supplied a PoC or technical exploit reference opened and verified during focused research. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| CISA KEVkev | ok1661 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok672 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1007 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| FIRST EPSSepss | ok7492 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 14 opened outside the registered collection
Technical references4
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code2
Merged Rapid7 contribution implementing and testing a public Metasploit exploit module.
Oasis technical report covering the disclosed attack paths, proof-of-concept research and remediation.
Vendor & gov advisories5
Primary advisory assigning CVE-2026-41679, affecting releases before 2026.416.0.
Primary advisory for the separate local_trusted browser attack; it lists no patched version.
Primary advisory documenting missing access checks and sensitive information exposure.
The 16 April 2026 release records authorization hardening for the import, approval, activity and heartbeat routes.
NVD corroborates unauthenticated remote command execution before 2026.416.0 and the critical GitHub-assigned score.
Analysis & research3
Original researcher analysis connects the three findings to executable Paperclip configuration crossing weak trust boundaries.
Rapid7 confirms that a CVE-2026-41679 exploit module shipped in its June 2026 release.
Secondary reporting published on 5 August 2026 separates the network, localhost and information-disclosure findings.