CVE-2026-41679: paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

CVE-2026-41679 · Severity: critical · CVSS 10 · Published 2026-04-23

Paperclip is an AI agent orchestration platform that allows companies to create and manage AI agents. An unauthenticated attacker can gain complete remote code execution on any publicly accessible Paperclip instance with default configuration by exploiting a chain of authorization flaws. This allows an attacker to fully compromise the server and run arbitrary commands with the application's privileges, potentially exposing sensitive customer data and AI agent workflows.

Technologies: @paperclipai/server (npm), Paperclip AI Paperclip. Vendors: npm, Paperclip, Paperclip AI.

Quick answers

Is CVE-2026-41679 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41679 being exploited in the wild.
How severe is CVE-2026-41679?
Critical severity, with a CVSS score of 10, published 23 April 2026.
Which products and versions are affected?
@paperclipai/server (npm) < 2026.410.0, SEMVER:introduced=0,fixed=2026.410.0; paperclipai (npm) < 2026.410.0, SEMVER:introduced=0,fixed=2026.410.0; Paperclip AI Paperclip < 2026.416.0.
Is there a fix for CVE-2026-41679?
Yes. @paperclipai/server (npm): upgrade to 2026.410.0 or later; paperclipai (npm): upgrade to 2026.410.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41679 attacked?
It is attacked over the network.
Am I affected by CVE-2026-41679?
Check whether you run @paperclipai/server (npm), paperclipai (npm), Paperclipai or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @paperclipai/server (npm): upgrade to 2026.410.0 or later
    npm install @paperclipai/server@2026.410.0
  • paperclipai (npm): upgrade to 2026.410.0 or later
    npm install paperclipai@2026.410.0

Technical details

The vulnerability chains four independent flaws: (1) open signup with no email verification (PAPERCLIP_AUTH_DISABLE_SIGN_UP defaults to false and email verification is hardcoded off), (2) unauthenticated CLI auth challenge creation with no actor validation, (3) CLI challenge approval that lacks cross-user checking (approver not validated as creator), and (4) the critical flaw: the company import endpoint at /import bypasses instance admin authorization checks that exist on direct company creation. The import endpoint accepts a .paperclip.yaml file with arbitrary agent adapter configuration; the process adapter directly calls spawn() without sandboxing. An attacker can chain these flaws: create an account, self-approve a CLI token, obtain a persistent API key, then import a malicious company bundle with shell commands in the adapter config to achieve RCE. The entire attack requires six unauthenticated API calls with no user interaction. Patches are available in version 2026.416.0 or later.

Affected products

  • Paperclip AI Paperclip < 2026.416.0
  • Paperclip AI paperclipai < 2026.416.0

Identifiers

  • CVE-2026-41679
  • GHSA-68qg-g8mg-6pr7

Timeline

  • 2026-04-10: disclosed: Vulnerability published as GHSA-68qg-g8mg-6pr7
  • 2026-04-10: patched: Version 2026.416.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.