CVE-2026-41679— Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41679
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
认证机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Paperclip 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Paperclip是Paperclip开源的一款AI代理团队编排工具。 Paperclip 2026.416.0之前版本存在授权问题漏洞，该漏洞源于在默认配置的authenticated模式下，未经身份验证的攻击者可通过六个API调用链实现完全远程代码执行，无需用户交互或凭据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| paperclipai | paperclip | < 2026.410.0 | - | |
| paperclipai | @paperclipai/server | < 2026.410.0 | - |
II. Public POCs for CVE-2026-41679
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41679
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same weakness: CWE-287
- CVE-2026-5229
Receive Notifications After Form Submitting – Form Notify fo - CVE-2026-8621
Crabbox < v0.12.0 Authentication Bypass via Header Spoofing - CVE-2026-20182
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulne - CVE-2026-8181
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to - CVE-2026-44351
fast-jwt: Empty HMAC secret accepted via async key resolver
V. Comments for CVE-2026-41679
No comments yet