Critical Paperclip flaw let attackers run code as server

Oasis Security reported a critical authorization bypass in the Paperclip AI management platform that could let remote attackers execute code with the server’s permissions. The issue is tracked as CVE-2026-41679 and carries a CVSS score of 10. The flaw affected network-accessible Paperclip instances running the default authenticated-mode configuration.

Oasis’s analysis shows an attacker could create an account without email verification, sign in immediately, start Paperclip’s CLI challenge-and-approval flow and self-approve the challenge. That process produced a persistent board-level API token tied to the attacker’s account. The board token granted access to company import routes that required only board-level access rather than the instance-admin privileges normally required to create companies.

Through the import path, an attacker could upload a crafted .paperclip.yaml that defined an agent using a host-level execution adapter and a command to run as the Paperclip server process. If executed, that command ran with the permissions of the service account that runs Paperclip on the host.

Depending on deployment, the service account’s permissions could include access to application data, source code repositories, local credentials, secrets exposed to agent processes and internal services reachable from the host. Oasis described the sequence of account creation, CLI approval and import as sufficient to reach the host-execution step.

Paperclip applied fixes that add authorization checks to import preview and import execution flows and tighten company scoping so creating or importing a company requires the correct administrative privileges. The vendor also resolved two additional flaws found by Oasis: missing authorization checks on certain API routes that could expose sensitive data, and a DNS rebinding-on-loopback weakness affecting local-development mode.

The DNS rebinding issue existed because local-development instances bound to 127.0.0.1 and treated all requests to that address as coming from trusted software. If a developer loaded an attacker-controlled web page in a browser, JavaScript on the page could bypass same-origin protections and reach the local Paperclip API. An attacker could then use a manipulated import operation to coerce Paperclip into running a command on the developer’s machine.

Oasis wrote in its technical report: “AI agents are becoming a new class of enterprise identity. Agentic workflows are distributed: a user delegates intent to an agent, the agent invokes other agents or tools, and each step may select a new credential. By the time an action reaches the target system, logs show only the final credential, not the originating user, the responsible agent, or the intended task.”

The vendor has published patches for the fixed flows. Administrators running network-accessible Paperclip instances with default authenticated-mode settings are advised to apply the vendor’s updates and review authorization settings and local-development bindings to limit exposure.