An authorization bypass in Paperclip could have allowed remote attackers to obtain arbitrary code execution with the server’s permissions, Oasis Security reports.
Paperclip is an AI management platform that allows organizations to operate autonomous AI agents at scale. It supports importing companies from portable bundles and YAML files that also define agents and commands they should execute.
Tracked as CVE-2026-41679 (CVSS score of 10), the critical security defect impacted network-accessible Paperclip instances with default authenticated-mode configurations.
A missing authorization check could be exploited to self-register an account without email verification, sign in to the account, create a CLI challenge and approve it, and then deploy an agent by importing a new company.
“A network attacker could create an account and sign in immediately, without an invitation or control of a verified mailbox. That session was enough to enter Paperclip’s CLI authorization flow, a challenge-and-approval process used to authorize a command-line client and activate a persistent board API credential,” Oasis notes in a technical report (PDF).
By self-approving the CLI authorization challenge, the attacker would have a board API token tied to their account, gaining board-level API access, including the ability to reach company import routes.
“Paperclip correctly restricted direct creation of a new company to an instance administrator, but the equivalent new-company import path enforced only board-level access. It did not require instance-admin privileges,” Oasis explains.
When importing the company, the attacker could use a crafted .paperclip.yaml to specify an agent that would use a host-level execution adapter, and define a command that the adapter would execute as the Paperclip server process.
“Successful exploitation provided the permissions of the service account running Paperclip. Depending on deployment, that could include access to application data, source repositories, local credentials, secrets exposed to agent processes, and internal services reachable from the host,” Oasis says.
Paperclip fixed the security defect by applying authorization checks to the import preview and import execution flows and tightening company scoping.
It also resolved two other bugs discovered by Oasis. One was a missing authorization on API routes, leading to sensitive data disclosure, while the other was a DNS rebinding on loopback weakness that could allow attackers to execute arbitrary code on developer machines.
The second issue existed because, in local-development mode, Paperclip would bind to 127.0.0.1 and trust all requests reaching the address as originating from trusted software.
If the developer loaded an attacker-controlled website in the browser, JavaScript code on the site would bypass same-origin protections, resulting in access to the local Paperclip API. Through an import operation, the attacker would manipulate Paperclip into executing a command on the developer’s computer.
“AI agents are becoming a new class of enterprise identity. Agentic workflows are distributed: a user delegates intent to an agent, the agent invokes other agents or tools, and each step may select a new credential. By the time an action reaches the target system, logs show only the final credential, not the originating user, the responsible agent, or the intended task,” Oasis notes.
Related: Cybersecurity Alliance Drafts SAFE Guidelines for Sharing AI Incident Data
Related: AI Agents Targeted Real People and Projects During Cybersecurity Tests
Related: Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer
Related: Critical Ruflo Flaw Lets Attackers Spawn Rogue AI Swarms
Source:
www.securityweek.com