"A systemic failure in how AI agent control planes handle identity boundaries."
CVE-2026-41679: self-registration turned into server-side code execution
Oasis Security published research on August 4 that found a chain of failures in Paperclip's authenticated deployment mode culminating in an unauthenticated attacker running commands on servers. The path began with self-registration: Paperclip allowed users to self-register without email verification, and its command-line authorization flow permitted a new user to approve their own credential challenge. That sequence converted the new account into a persistent board-level API key with no separate approver.
The report says that key could be used against Paperclip's company import route. While direct company creation was restricted to instance administrators, the import path only checked for board-level access. An attacker could import a bundle containing an agent configured with Paperclip's process adapter — a legitimate feature that launches a specified command as a child process. Waking that agent ran the attacker's command with the server's operating-system privileges. The issue is tracked as CVE-2026-41679 and carries a CVSS score of 10.0.
GHSA-xfqj-r5qw-8g4j: missing access checks expose telemetry and docs
Oasis uncovered additional routes that omitted access checks entirely. Tracked as GHSA-xfqj-r5qw-8g4j and rated CVSS 8.3, these gaps exposed heartbeat data, agent documentation and health information. Although the findings did not all lead directly to code execution, they provided observable state and metadata that could make exploitation easier or reveal attackable surfaces in deployed instances.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageGHSA-x8hx-rhr2-9rf7: DNS rebinding turned a developer's browser into an administrator
The third finding, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), traced a different but related path to the same execution sink. In local development mode Paperclip binds to loopback and treats every request as an implicit instance administrator — an assumption valid for trusted local clients but not for untrusted web pages. Oasis demonstrated that DNS rebinding allowed an attacker-controlled webpage to cross that boundary. After the attacker's hostname became unreachable, the browser retried the hostname against loopback while preserving same-origin status. Paperclip accepted those rebound requests as administrator actions; the malicious page imported and woke an agent that executed commands on the developer's machine.
Patches issued: Paperclip 2026.416.0 and 0.3.1
Following Oasis's disclosure, Paperclip released fixes for all three vulnerabilities. The two authenticated-mode issues were addressed in Paperclip 2026.416.0, which now requires instance administrator privileges for new-company imports. The rebinding flaw in local mode was fixed in Paperclip 0.3.1 by enabling hostname validation in local deployments. The report places these patches in direct response to the disclosed chains of failure that allowed privilege escalation and remote or local command execution.
What this means for developers, enterprises, and attackers
- Developers and open-source maintainers: Local development assumptions matter. The rebinding chain shows that treating loopback bindings as an implicit administrator presumes a threat model that does not include browser-origin attacks. The applied hostname validation in 0.3.1 targets that specific assumption.
- Enterprises running Paperclip instances: Authenticated-mode import paths and board-level API keys can create privilege gaps. The 2026.416.0 update narrows an import path that previously checked only for board-level access; operators should prioritize that update to close the import vector.
- Threat actors and red teams: The research demonstrates two practical avenues — server-side via import chains and developer-side via browser DNS rebinding — to reach the same command-execution sink. Where attacker-controlled agent configuration is possible, the platform’s process adapter provides a direct mechanism to run commands with host privileges.
The Paperclip findings arrived amid a run of similar disclosures, the Oasis report notes, citing a critical Flowise flaw and a Langflow bug that was exploited within 20 hours. All three Paperclip issues have been patched, but the chain described — from identity and approval flows to import checks and local-mode assumptions — highlights how multiple small failures can compose a single, high-impact breach path.
Oasis's work, and Paperclip's subsequent fixes in 2026.416.0 and 0.3.1, close the specific doors the researchers opened. The remaining question the report leaves on the table is whether other agent control planes share the same concatenation of self-registration, inadequate import checks, and local-mode trust assumptions — a pattern the security community will likely watch closely.
Original story: https://www.infosecurity-magazine.com/news/paperclip-ai-vulnerabilities-rce/
