Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-41679— Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Quick assessment

Affected
paperclipai paperclip
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Paperclip是Paperclip开源的一款AI代理团队编排工具。 Paperclip 2026.416.0之前版本存在授权问题漏洞，该漏洞源于在默认配置的authenticated模式下，未经身份验证的攻击者可通过六个API调用链实现完全远程代码执行，无需用户交互或凭据。

CVSS 10.0 · Critical EPSS 7.36% · P94

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-41679

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Paperclip 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Paperclip是Paperclip开源的一款AI代理团队编排工具。 Paperclip 2026.416.0之前版本存在授权问题漏洞，该漏洞源于在默认配置的authenticated模式下，未经身份验证的攻击者可通过六个API调用链实现完全远程代码执行，无需用户交互或凭据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
paperclipai paperclip < 2026.410.0 -
paperclipai @paperclipai/server < 2026.410.0 -

II. Public POCs for CVE-2026-41679

# POC Description Source Link Shenlong Link
1 Paperclip < 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41679.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-41679

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-41679 (1)

IV. Related Vulnerabilities

Same product: paperclip
Same vendor: paperclipai
Same weakness: CWE-287

V. Comments for CVE-2026-41679

No comments yet

Leave a comment