Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 16 April 2026.

Which products and versions are affected?

@paperclipai/server (npm) SEMVER:introduced=0,fixed=2026.416.0.

Is there a fix for This vulnerability?

Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run @paperclipai/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Paperclip cross-tenant agent API token minting authorization bypass

Severity: low · CVSS 3.1 · Published 2026-04-16

Paperclip is an open-source application for managing AI agents in a multi-tenant environment. A critical authorization flaw in the API key management endpoints allows any authenticated user—even one with no company memberships—to mint valid API tokens for agents belonging to other companies. An attacker can use these stolen tokens to read sensitive company data (issues, approvals, agent configuration) and perform administrative actions on victim agents. This completely bypasses Paperclip's tenant isolation security model.

Technologies: @paperclipai/server (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 16 April 2026.
Which products and versions are affected?: @paperclipai/server (npm) SEMVER:introduced=0,fixed=2026.416.0.
Is there a fix for This vulnerability?: Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run @paperclipai/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@paperclipai/server (npm): upgrade to 2026.416.0 or later
```
npm install @paperclipai/server@2026.416.0
```

Technical details

The vulnerability is a missing authorization check in three API handlers in server/src/routes/agents.ts (lines 2050–2087): POST /api/agents/:id/keys, GET /api/agents/:id/keys, and DELETE /api/agents/:id/keys/:keyId. These endpoints call assertBoard() to verify the caller is authenticated, but never call assertCompanyAccess() to verify the caller belongs to the agent's company. The root cause is that agent API keys are created with the victim agent's companyId bound server-side; when resolved via the authentication middleware, any bearer token for that key is treated as belonging to the victim tenant. An unauthenticated attacker can sign up, obtain an agent ID (which leaks via activity feeds and other endpoints), then POST to mint a plaintext pcp_* token for any agent. The same authorization bypass pattern exists in agent lifecycle handlers (pause, resume, terminate, delete). The vulnerability requires authenticated mode and sign-up enabled (both default configurations). A patch is available in version 2026.416.0.

Affected products

Paperclip AI @paperclipai/server <= 2026.411.0-canary.8

Timeline

2026-04-16: disclosed: GHSA-47wq-cj9q-wpmp published
2026-04-16: patched: Patch released in version 2026.416.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.