CVE Intelligence
Analysis AI-assisted

CVE-2026-41679: Paperclip Unauthenticated RCE via Import Authorization Bypass

Paperclip, a Node.js and React platform for orchestrating AI agents, has a critical flaw that the record says allows unauthenticated remote code execution before version 2026.416.0. The record describes instances in 'authenticated' mode with default configuration as affected and assigns a CVSS 3.1 score of 10. No confirmed exploitation appears in the sources consulted, and the record states that version 2026.416.0 patches the issue.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Paperclip is a Node.js server and React UI for orchestrating teams of AI agents. According to the advisory summarized in the record, versions before 2026.416.0 allow an unauthenticated remote attacker to achieve full remote code execution on network-accessible instances running in 'authenticated' mode with default configuration. The record states that the attack chain involves six API calls; this analysis does not describe them.

Impact

If the record is accurate, an attacker could gain full control of the host running an affected instance without credentials or user interaction. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H gives a base score of 10, rated critical. The assigned weakness is CWE-287, Improper Authentication.

Affected products and versions

  • Versions before 2026.416.0 are described as affected by the advisory.
  • The record lists '< 2026.416.0' for the Paperclip Paperclipai and Paperclipai/server entries.
  • The record lists 'version < 2026.410.0' for the Paperclipai @paperclipai/server and Paperclipai Paperclip entries. The record does not explain this difference.
  • Unknown: the record does not clarify how the two thresholds apply to deployments between 2026.410.0 and 2026.416.0. Verify with the vendor before relying on either boundary.

Exploitation status

The record shows that the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The record's SSVC field reports exploitation as 'poc' and automatable as 'yes'. Under SSVC, 'poc' generally indicates that a proof of concept exists; this is an inference, not a confirmed exploitation event. The EPSS probability is 0.07365 with percentile 0.94404, but the EPSS date in the record is later than the publication date, so its currency should be verified.

Remediation and mitigation

  • Upgrade affected Paperclip deployments to version 2026.416.0 or later, which the record states patches the issue.
  • Review the GitHub security advisory for vendor guidance and any additional mitigation steps.
  • Do not expose Paperclip instances directly to untrusted networks; restrict access to trusted hosts while patching is pending.
  • Inventory all Paperclip instances, including those running the server package, and confirm their installed versions.
  • Compare the authentication mode and configuration of each instance against vendor guidance.

Detection guidance

  • Review web and API access logs for requests from unfamiliar sources, particularly around import functionality.
  • Watch for unexpected child processes or outbound connections originating from the Node.js service process.
  • Look for unexpected changes to agent configurations, accounts or data following import activity.
  • These indicators are general; the record does not list specific indicators of compromise.

Limitations of the available information

  • The record does not describe the individual API calls or the vulnerable component in detail, and this analysis does not add them.
  • The affected version thresholds differ between product entries.
  • The record does not confirm whether any instance has been exploited.
  • The EPSS date is later than the publication date.
  • Only the advisory, NVD and CVE record pages referenced in the record were used.

Frequently asked questions

Does exploitation require credentials or user interaction?

According to the record, no credentials or user interaction are required against network-accessible instances in 'authenticated' mode with default configuration.

Which version fixes the issue?

The record states that version 2026.416.0 patches the issue, and the GitHub advisory is listed as a mitigation reference.

Is this vulnerability known to be exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC field reports 'poc', which is an inference about proof-of-concept availability.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.