"Agent configuration must be treated as executable input," Oasis Security warned, a short sentence that ties together three distinct weaknesses in Paperclip and explains how harmless-looking configuration can become a remote execution vector.
CVE-2026-41679: a server-side import chain that becomes command execution
One of the flaws — tracked as CVE-2026-41679 and scored 10.0 by CVSS — allows an unauthenticated actor to register on a network-accessible Paperclip instance running in authenticated mode with the default registration settings, create and approve a CLI authorization, and import a crafted .paperclip.yaml bundle that defines a new company and a process-based agent. Because the import route accepted board-level credentials as sufficient for creating a company, the attacker became a company member; the normal wakeup check passed and Paperclip's built-in process adapter launched the attacker-supplied command as a child process of the server.
Oasis's technical report and accompanying analysis explain the practical impact: the command runs with the host service account and can access application data, source repositories, locally stored credentials, any secrets available to agent processes, and internal services reachable from the machine. Rapid7 published a Metasploit module that automates the six-request attack chain, and NVD carries a CISA-ADP enrichment marking the flaw as automatable with total technical impact and proof-of-concept exploitation.
GHSA-x8hx-rhr2-9rf7: DNS rebinding against local_trusted deployments
The second critical path, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), targets Paperclip running in its default local_trusted development configuration. In that mode the service historically treated any request reaching the loopback-bound service as implicitly administrative. Oasis demonstrated a DNS-rebinding sequence in which a browser first loaded JavaScript from an attacker-controlled host and, after the attacker's server stopped answering, later requests to the same hostname resolved to 127.0.0.1. Because the browser continued to treat those requests as same-origin and Paperclip accepted the attacker's Host header, the page could call the import API, install a company with a process-based agent, and invoke its wakeup endpoint. No Paperclip token, session cookie, or stolen credential was required; Oasis verified the proof of concept on macOS with Firefox, though the public record does not claim identical end-to-end behavior across every browser or OS.
Paperclip's direct remediation was hostname validation: the source tagged v2026.416.0 enables a private-hostname guard that rejects rebound requests carrying an unapproved hostname before identity-assignment middleware runs. That guard is applied for private deployments running in either local_trusted or authenticated mode.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildGHSA-xfqj-r5qw-8g4j: API routes that leaked control-plane details and data
The third advisory, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), covers several authenticated-mode API routes that did not consistently block unauthenticated or cross-company requests. Examples include a heartbeat-run identifier that allowed retrieval of associated issue data without proving company access, routes that returned agent-facing skill documentation and API/authentication conventions, and health endpoints that disclosed deployment mode, version, authentication readiness, bootstrap state, exposure, and feature flags.
Paperclip's design allowed unauthenticated requests to continue through middleware with a "no actor" identity and left each route to apply its own checks. The fixes applied in v2026.416.0 add authentication to general skill routes, company-access checks to heartbeat issue retrieval, invite-scoped onboarding routes, and a reduced health response for unauthenticated callers; the unauthenticated CLI challenge route — part of the import credential chain used in CVE-2026-41679 — was also addressed.
Patch status, version labels, and operational guidance
Paperclip fixed the import-authorization and hostname-validation issues in the source tagged v2026.416.0. That tagged code requires instance-administrator access for imports that create a new company and requires company access for imports targeting existing companies; it also blocks process and HTTP adapters from the restricted agent-safe import path. Oasis recommends v2026.416.0 or later and Paperclip's release notes tell all deployments to upgrade.
Readers should note a record mismatch: the GitHub tag is v2026.416.0, while the server and CLI manifests inside that tag report version 0.3.1. The DNS-rebinding advisory listed no patched version at the time of reporting, and NVD retained older affected-version metadata in its history. The Hacker News review found the hostname guard enabled in v2026.416.0, but the advisories' metadata did not all align — the safest operational reading is to upgrade to v2026.416.0 or later.
What this means for technologists and security teams, operators and procurement, and developers
- Technologists and security teams: treat imported agent configuration as executable input in threat models; prioritize installing v2026.416.0 or later, audit registration and import flows, and monitor for automated exploit code such as the Rapid7 Metasploit module.
- Operators and procurement leaders: review deployment exposure and the use of open registration or local_trusted mode in production environments; follow Oasis's recommendation to upgrade and validate that hostname guards and import authorization checks are active.
- End users and developers working on local machines: avoid running default local_trusted deployments on systems with sensitive local resources, and be aware that a browser visiting an attacker-controlled page could — with DNS rebinding — reach a loopback service treated as administrative unless patched.
No authoritative source reviewed by The Hacker News reported exploitation in the wild as of August 5, 2026, and the vulnerability was not listed in CISA's Known Exploited Vulnerabilities catalog on that date; absence from KEV does not rule out exploitation. Given that Rapid7 has published an exploit module and NVD records CISA enrichments signaling automatable, proof-of-concept exploitation, the immediate and concrete step for operators is the one Paperclip and Oasis both recommend: install v2026.416.0 or later and review how registration and deployment exposure are configured.
Original reporting: https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html
