Paperclip CVE-2026-41679: 6 API Calls from Public Registration to AI Agent Host Process RCE

Basic Information

• Article Title: Critical Paperclip Flaw Allowed Admin Access, Code Execution
• Publisher: SecurityWeek
• Publication Date: August 6, 2026
• Original Source: SecurityWeek
• Related Sources: CERT Santé / GHSA-68qg-g8mg-6pr7
• Related CVE & Products: CVE-2026-41679, Paperclip AI agent orchestration, @paperclipai/server, paperclipai
• Affected Versions: Versions prior to 2026.416.0. Fixed in version 2026.416.0
• Severity: Critical

Executive Summary

This is an attack chain on internet-exposed Paperclip instances. An attacker registers an account, self-approves a CLI key, and abuses an alternative import path for admin-only company creation. Finally, they use an unsandboxed process adapter in .paperclip.yaml to execute arbitrary commands with server privileges.

Attack Flow

Chain A: Remote Server Takeover

• Register a new account without email verification.
• Create a CLI challenge and approve it themselves to get a permanent board API key.
• Call POST /api/companies/import in new_company mode.
• Bypass the instance-admin check (which exists in direct company creation) via the import route.
• Put a process adapter and malicious command / args into the .paperclip.yaml import bundle.
• Call the imported agent's wakeup endpoint to execute commands via Node.js spawn() as the server user.

Chain B: Local-Dev DNS Rebinding (Alternative Flaw)

• A developer visits an attacker's website.
• DNS rebinding reaches the loopback Paperclip API from the browser.
• Send agent/import commands to the local API.
• Execute commands on the developer's device.

Attacker Position and Execution Context

• The remote chain is executed by an external attacker with HTTP access to the Paperclip API.
• Commands run within the OS user, filesystem, and network context of the Paperclip server process.
• The local-dev chain uses the victim's browser as a relay to reach the loopback instance.
• Subsequent targets include source