Vulnerability Report

CVE-2026-41679

RCE

Title: Unauthenticated Remote Code Execution in Paperclip

Auth Bypass

Proof Of Concept

PoC Available for CVE-2026-41679

CWE Category CWE-287

Published Date Apr 23, 2026

Modified Date Apr 27, 2026

Exploit Status Available

Score 10.0 CVSS v3.1

Exploit Probability (EPSS)

1.97%

Vulnerability Summary

CVE-2026-41679: Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.

Impacted Vendors

paperclip 2

Reference Links

https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

10.0

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns