Critical Paperclip Flaw Exposes Admin Access & Code Execution Vulnerability

Post Views: 15

Security researchers uncovered a critical vulnerability in Paperclip that allowed remote code execution with server-level privileges.

Vulnerability Overview

A security vulnerability in Paperclip enabled potential remote attackers to execute arbitrary code with server-level privileges, according to a report from Oasis Security. Paperclip is an AI management platform designed to facilitate the deployment and operation of autonomous AI agents at scale. It allows organizations to import company configurations through portable bundles and YAML files, which define agents and their associated commands.

Flaw Details

The flaw, tracked as CVE-2026-41679 with a CVSS score of 10, affected Paperclip instances configured to use default authenticated modes. The vulnerability stemmed from a missing authorization check that could be exploited to bypass security controls. An attacker could create an account and authenticate without requiring an invitation or verification of a valid email address.

Exploitation Process

This access would then allow the attacker to initiate the CLI authorization flow, a process used to validate and grant persistent API credentials to command-line clients. By self-approving the authorization challenge, the attacker would obtain a board API token linked to their account, granting access to board-level API functions, including company import routes.

Impact and Risks

Paperclip restricted direct company creation to instance administrators, but the import path for new companies only enforced board-level access. This discrepancy allowed attackers to bypass administrative privileges during the import process. By using a maliciously crafted paperclip.yaml file, the attacker could define an agent configured to use a host-level execution adapter. This setup would enable the execution of arbitrary commands as the Paperclip server process.

Successful exploitation would grant the attacker the permissions of the service account running Paperclip, potentially exposing application data, source repositories, local credentials, secrets accessible to agent processes, and internal services hosted on the same machine.

Mitigation and Fixes

Paperclip addressed the vulnerability by implementing authorization checks for import preview and execution workflows and refining company scoping mechanisms. The platform also resolved two additional issues identified by Oasis Security. One involved a lack of authorization on specific API routes, leading to potential data exposure. The second issue was a DNS rebinding vulnerability in local-development mode, where Paperclip bound to 127.0.0.1 and trusted all incoming requests.

Local-Development Risk

If a developer accessed an attacker-controlled website, JavaScript on the site could bypass same-origin protections and interact with the local Paperclip API. Through an import operation, this could be leveraged to execute commands on the developer’s machine.

Broader Implications

Oasis Security highlighted broader implications for AI agent security, noting that agentic workflows introduce new challenges for enterprise identity management. These workflows involve distributed interactions where a user delegates tasks to agents, which may invoke other agents or tools. Each step could use different credentials, making it difficult to trace actions back to the original user or agent.

Security Recommendations

The report underscores the growing complexity of securing AI-driven systems, emphasizing the need for robust authorization mechanisms and continuous monitoring of agent behavior. Organizations deploying AI platforms must prioritize rigorous validation of import processes and ensure that all API endpoints enforce strict access controls.