Paperclip AI Agent Control Plane Unauthenticated RCE (CVE-2026-41679)

Paperclip, an open-source control plane for managing teams of AI agents, in network-accessible deployments using default authenticated mode

Oasis Security disclosed three flaws. In the server-side chain (CVE-2026-41679, CVSS 10.0) an unauthenticated attacker self-registers without verification, approves their own CLI authorization request to obtain persistent board-level API access with no separate administrative approval, imports a company definition containing a process-based agent whose command they choose, then calls the wake-up endpoint so the process adapter runs that command as the Paperclip server's operating system user. A second issue (GHSA-x8hx-rhr2-9rf7, CVSS 9.6) uses DNS rebinding, resolving an attacker-controlled hostname to both the attacker's server and 127.0.0.1, to reach a local deployment running in `local_trusted` mode from the browser. A third (GHSA-xfqj-r5qw-8g4j, CVSS 8.3) grants unauthorized API access across company scoping boundaries. Paperclip fixed the import authorization mismatch and the company-scoping gaps in version 2026.416.0 and separately hardened local mode with Host-header validation and stricter import controls

Implicit trust at each boundary: a self-issued credential accepted as authorization, an unguarded route, and loopback binding treated as an access control. The agent import path accepted an arbitrary command as configuration data, so administrative access and code execution were the same privilege