Three critical vulnerabilities have been identified in Paperclip, an open-source AI agent orchestration platform, potentially allowing unauthenticated command execution on servers and developer machines, as well as exposing sensitive data. The flaws were discovered by Oasis Security during an assessment of Paperclip's authenticated and local deployment modes.
One vulnerability, tracked as CVE-2026-41679, received a CVSS score of 10.0. This flaw affected authenticated deployments, stemming from Paperclip's self-registration process, which lacked email verification. An attacker could exploit the command-line interface (CLI) authorization flow to approve their own credential challenge, thereby obtaining a persistent board-level API key. This key could then be used with the company import route. Although direct company creation was restricted to instance administrators, the import path only checked for board-level access. Attackers could leverage this to introduce a bundle containing an agent configured with the process adapter, a legitimate feature designed to launch specified commands as child processes. Activating this malicious agent would then execute the attacker's command with the server's operating system privileges.
A second issue, identified as GHSA-xfqj-r5qw-8g4j (CVSS 8.3), involved several routes that lacked proper access checks. This oversight exposed sensitive information such as heartbeat data, agent documentation, and health status.
The third vulnerability, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), allowed for remote code execution in Paperclip's local development mode. In this mode, Paperclip binds to the loopback interface and implicitly treats all requests as originating from an instance administrator. While this assumption holds for local clients, it does not account for browsers. An attacker could exploit DNS rebinding to bypass this boundary. An attacker-controlled webpage could cause a browser to retry a hostname against the loopback interface once the attacker's server became unreachable, while still maintaining a same-origin connection. Paperclip would then accept these rebound requests as administrator actions, allowing the malicious webpage to import and activate an agent, executing commands on the developer's machine.
Paperclip's developers describe the platform as a control plane for operating "zero-human companies," which underscores the potential impact of these vulnerabilities on automated systems.
All three vulnerabilities have been patched following their disclosure. The two flaws affecting authenticated deployments were addressed in Paperclip version 2026.416.0, which now mandates instance administrator privileges for new-company imports. The DNS rebinding vulnerability in local development mode was fixed in version 0.3.1, which introduces hostname validation.
