Executive brief
Paperclip Server is an AI agent orchestration platform that manages workflows and integrations. Multiple critical API endpoints lack authentication checks, allowing attackers to access sensitive heartbeat run data, retrieve complete system documentation and agent instructions, obtain pre-generated API keys, and enumerate deployment configuration—all without any credentials or login.
Technical details
The vulnerability is a missing authentication check (CWE-306) affecting multiple API endpoints across authenticated deployments. Four classes of issues exist: (1) GET /api/heartbeat-runs/:runId/issues lacks assertCompanyAccess, exposing issue data; (2) POST /api/cli-auth/challenges has no actor verification, returning pre-generated boardApiTokens; (3) GET /api/skills/* endpoints leak complete agent instructions, API maps, and authentication protocols; (4) GET /api/health exposes deployment mode, version, and feature flags. The root cause is reliance on per-endpoint authentication checks rather than middleware-level enforcement; unauthenticated requests receive actor: {type: "none"} and pass through to route handlers that may skip verification. Attack requires only network access; no authentication or user interaction needed. Fix was released in version 2026.416.0.
Affected products
- Paperclip AI Server prior to 2026.416.0
Timeline
- 2026-04-16: disclosed
- 2026-04-16: patched: Fixed in version 2026.416.0