CVE-2026-41679 · Paperclip is a Node.js server and React UI that orchestrates a team…

01 · The Real Story

Someone left the factory floor unlocked, and there is a loaded forklift with the keys in the ignition

CVE-2026-41679 is an unauthenticated remote code execution vulnerability in Paperclip, the open-source Node.js/React platform that orchestrates teams of AI agents. All versions prior to 2026.416.0 are affected. The flaw chains three weaknesses — open self-registration (CWE-1188), self-approval of CLI authorization challenges (CWE-287), and missing authorization on the company-import route (CWE-862) — into a six-API-call sequence that goes from zero access to arbitrary OS command execution as the Paperclip server process user. No credentials, no user interaction, no special configuration required; the default deployment is vulnerable.

The vendor scored this a perfect CVSS 10.0 CRITICAL, and for once that label is accurate. The attack surface is network-reachable by design, the chain is fully automated (a public Metasploit module and a bash PoC both exist), and the blast radius includes the server filesystem, all tenant data, every stored API key and secret available to the agent runtime, plus a pivot point into the internal network. EPSS sits at ~2% today, but that number lags the weaponization reality: Rapid7 shipped exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679 to Metasploit in August 2026. Exploitation is when, not if.

"Unauth RCE in 6 API calls with a public Metasploit module. If you run Paperclip, patch now."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Self-register an account

The attacker sends a POST to the Paperclip signup endpoint. No invitation token, no email verification, no CAPTCHA. The server returns a valid session cookie. This works on every default authenticated-mode deployment.

Conditions required:

Network reachability to the Paperclip HTTP port (default 3000)

Where this breaks in practice:

Instance must be network-accessible to the attacker — many dev instances sit behind a VPN or on localhost

Detection/coverage: WAF/proxy logs will show POST to /api/auth/signup from an unknown source IP.

STEP 02

Create and self-approve a CLI challenge

The attacker hits the unauthenticated CLI challenge endpoint to create an authorization challenge, then immediately approves it using the session from Step 1. This yields a persistent board-level API key — a credential that normally implies trusted operator status.

Conditions required:

Valid session cookie from Step 1

Where this breaks in practice:

None — the endpoint is unauthenticated by design and the approval logic has no secondary gate

Detection/coverage: Audit logs (if enabled) will show a CLI challenge created and approved within seconds by a brand-new user.

STEP 03

Import a malicious .paperclip.yaml bundle

Using the board API key, the attacker calls the import-preview and then import-execute routes with a crafted .paperclip.yaml that defines a new company and a process-adapter agent. The import route incorrectly accepts board-level credentials for operations that should require instance-administrator access when targeting a new company.

Conditions required:

Board-level API key from Step 2

Where this breaks in practice:

None — the authorization check is simply missing

Detection/coverage: File-integrity monitoring on the Paperclip data directory would flag new company/agent artifacts.

STEP 04

Trigger the malicious agent

The attacker activates the imported process-adapter agent via the API. The agent executes the attacker-supplied shell command with the privileges of the Paperclip Node.js server process (typically a non-root Linux user, but with full access to application data, environment variables, and network).

Conditions required:

Imported agent definition from Step 3

Where this breaks in practice:

None — agent activation is an expected platform operation

Detection/coverage: Process monitoring / EDR on the host will see a child process spawned by the Node.js runtime executing unexpected commands (e.g., curl, wget, reverse shell).

STEP 05

Harvest secrets and pivot

With OS-level code execution, the attacker reads environment variables (database credentials, third-party API keys injected for agents), accesses the PostgreSQL database directly, and scans the internal network. Paperclip deployments often hold OpenAI/Anthropic API keys, source-repo tokens, and cloud provider credentials used by agents.

Conditions required:

Shell access from Step 4

Where this breaks in practice:

Network segmentation and least-privilege IAM would limit lateral movement, but most startup/dev deployments lack these

Detection/coverage: Network IDS will flag unusual outbound connections from the Paperclip host. Cloud provider anomaly detection may flag API key usage from a new IP.

03 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	Not confirmed. No authoritative source reported exploitation as of 2026-08-05. Not listed in CISA KEV. However, the Metasploit module is public and the barrier to entry is near zero.
Proof-of-concept	Fully weaponized. Metasploit module `exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679` by h00die-gr3y. A standalone `poc_exploit.sh` bash script also exists that completes the chain in under 30 seconds.
EPSS score	0.01972 (~2nd percentile). This lags the weaponization state significantly — expect rapid increase now that a Metasploit module is merged.
KEV status	Not listed as of 2026-08-06.
CVSS vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — perfect 10.0. Network vector, no privileges, no interaction, scope change to resources beyond the vulnerable component.
Affected versions	All Paperclip versions prior to 2026.416.0 (and prior to 2026.410.0 for partial fix).
Fixed version	2026.416.0 — import routes now require instance-administrator access for new-company imports and company-level access for existing-company imports.
Scanning / exposure	No GreyNoise or Shodan tags observed yet. Paperclip instances typically run on port 3000 behind a reverse proxy. The project has 42,000+ GitHub stars but only 1 dependent npm package, suggesting adoption is developer/startup-skewed rather than large-enterprise.
Disclosure date	2026-04-23 (GitHub Security Advisory GHSA-68qg-g8mg-6pr7).
Credit	Oasis Security (research and technical report), h00die-gr3y / Rapid7 (Metasploit module).

04 · The Call

noisgate verdict.

Final Verdict

= UNCHANGED to CRITICAL (9.8/10)

The single most decisive factor is the zero-authentication, fully-weaponized attack chain: six API calls from anonymous to OS-level RCE with a public Metasploit module, against the default deployment configuration. No prerequisite in the chain requires any prior compromise, insider access, or non-default setting — the attack surface is the network port itself.

HIGH Vulnerability existence and exploitability

HIGH Metasploit module reliability

MEDIUM Enterprise install-base prevalence

LOW Active in-the-wild exploitation

Why this verdict

Zero friction in the chain. Every step from signup to RCE succeeds against default configuration. There is no authentication gate, no MFA, no email verification, no invite requirement, and no rate limiting. The only prerequisite is TCP reachability to the Paperclip port.
Fully weaponized. Rapid7 merged a Metasploit module in August 2026. A standalone bash PoC completes the chain in under 30 seconds. This moves the threat from theoretical to script-kiddie-accessible.
Secrets multiplier. Paperclip is designed to hold third-party API keys (OpenAI, Anthropic, cloud providers), database credentials, and source-repo tokens for its AI agents. Compromise of the Paperclip host yields these secrets, making the blast radius extend far beyond the single server.
Role multiplier: Paperclip is deployed as an AI agent orchestration server. In startups and dev teams, it is typically a *line-of-business application server* (role b). However, when configured with production API keys, cloud credentials, and source-repo tokens, it functions as a de facto secrets store and CI/CD-adjacent automation server (role c). The chain succeeds in all deployment roles. In the high-value role, compromise yields supply-chain-adjacent access (source repos, cloud credentials, production API keys) — blast radius is tenant-to-organization scale. This floors the verdict at HIGH and the zero-friction unauth chain pushes it to CRITICAL.
Default-on vulnerability. The insecure configuration is not an edge case — it is the documented, recommended deployment mode. Every Paperclip instance that followed the official installation guide is vulnerable unless manually hardened.

Why not higher?

The verdict is already at the ceiling. A 9.8 rather than 10.0 reflects a minor reservation: the Scope:Changed claim in the vendor vector is aggressive — while the attacker can access secrets for other services, the initial code execution is on the Paperclip host itself, not a different security authority. This is a semantic CVSS distinction, not a practical one.

Why not lower?

Downgrading would require evidence that the attack chain has meaningful friction or that the install base is negligible. Neither applies: the chain is frictionless (zero auth, default config, fully automated), a Metasploit module exists, and Paperclip has 42,000+ GitHub stars with active adoption. The secrets-store role multiplier prevents any downgrade below HIGH, and the zero-friction unauth RCE keeps it at CRITICAL.

05 · Compensating Control

What to do — in priority order.

Restrict network access to Paperclip instances immediately — Place Paperclip behind a VPN, SSH tunnel, or zero-trust proxy (e.g., Cloudflare Access, Tailscale) so that only authenticated operators can reach the HTTP port. This is the single most effective compensating control because the entire chain requires network reachability. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL.
Disable open self-registration — If Paperclip supports an environment variable or config flag to disable public signup (check docs for DISABLE_SIGNUP=true or equivalent), set it immediately. This breaks Step 1 of the chain. Deploy within 3 days.
Rotate all secrets stored in or accessible to Paperclip — Assume any API keys, database credentials, cloud tokens, or source-repo tokens configured in Paperclip agent workflows are compromised if the instance was ever internet-facing. Rotate them now. This limits blast radius even if exploitation already occurred.
Deploy application-layer WAF rules — Block unauthenticated POST requests to /api/auth/signup and the CLI challenge endpoints from external IPs. This is a stopgap — not a substitute for patching — but buys time if VPN deployment is delayed.
Monitor for indicators of compromise — Search Paperclip audit logs and host process logs for: new user registrations from unknown IPs, CLI challenge creation/approval in rapid succession, company imports by non-admin users, and unexpected child processes spawned by the Node.js runtime.

What doesn't work

Rate limiting alone — the entire chain is six requests. Even aggressive rate limiting (e.g., 10 req/min) will not prevent exploitation; the attacker needs fewer than 10 requests total.
WAF signature for known PoC payloads — the malicious .paperclip.yaml content is attacker-controlled and infinitely variable. Signature-based detection will miss trivial rewrites of the agent command.
Node.js runtime sandboxing (e.g., --experimental-permission) — Paperclip's process-adapter agents are *designed* to execute OS commands; sandboxing the runtime would break legitimate agent functionality.

06 · Verification

Crowdsourced verification payload.

Run this script on each host where Paperclip is installed, or from an auditor workstation pointed at the Paperclip URL. No special privileges required — it only checks the installed version via the npm registry or a running instance's API. Usage: bash check_cve_2026_41679.sh [http://paperclip-host:3000] or bash check_cve_2026_41679.sh --local.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash\n# check_cve_2026_41679.sh — Check for CVE-2026-41679 in Paperclip\n# Usage: bash check_cve_2026_41679.sh [URL|--local]\n# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN\n\nset -euo pipefail\n\nFIXED_MAJOR=2026\nFIXED_MINOR=416\nFIXED_PATCH=0\n\nversion_vulnerable() {\n  local ver=\"$1\"\n  # Expected format: 2026.NNN.N\n  IFS='.' read -r major minor patch <<< \"$ver\"\n  if [[ -z \"$major\" || -z \"$minor\" ]]; then\n    return 2\n  fi\n  if (( major < FIXED_MAJOR )); then\n    return 0  # vulnerable\n  elif (( major == FIXED_MAJOR && minor < FIXED_MINOR )); then\n    return 0  # vulnerable\n  elif (( major == FIXED_MAJOR && minor == FIXED_MINOR && ${patch:-0} < FIXED_PATCH )); then\n    return 0  # vulnerable\n  fi\n  return 1  # patched\n}\n\nif [[ \"${1:-}\" == \"--local\" ]]; then\n  # Check local npm package version\n  if ! command -v npm &>/dev/null; then\n    echo \"UNKNOWN — npm not found on this host\"\n    exit 2\n  fi\n  VER=$(npm list paperclipai 2>/dev/null | grep -oP 'paperclipai@\\K[0-9.]+' | head -1)\n  if [[ -z \"$VER\" ]]; then\n    echo \"UNKNOWN — paperclipai package not found locally\"\n    exit 2\n  fi\nelif [[ -n \"${1:-}\" ]]; then\n  # Check remote instance via API\n  RESP=$(curl -sf --max-time 5 \"${1}/api/system/info\" 2>/dev/null || true)\n  if [[ -z \"$RESP\" ]]; then\n    # Fallback: try healthcheck endpoint\n    RESP=$(curl -sf --max-time 5 \"${1}/api/health\" 2>/dev/null || true)\n  fi\n  VER=$(echo \"$RESP\" | grep -oP '\"version\"\\s*:\\s*\"\\K[0-9.]+' | head -1)\n  if [[ -z \"$VER\" ]]; then\n    echo \"UNKNOWN — could not retrieve version from $1\"\n    exit 2\n  fi\nelse\n  echo \"Usage: $0 [http://paperclip-host:3000|--local]\"\n  exit 2\nfi\n\necho \"Detected Paperclip version: $VER\"\necho \"Fixed version: ${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}\"\n\nif version_vulnerable \"$VER\"; then\n  echo \"VULNERABLE — CVE-2026-41679 affects this version\"\n  exit 1\nelse\n  echo \"PATCHED — version $VER is at or above the fix\"\n  exit 0\nfi

07 · Bottom Line

If you remember one thing.

TL;DR

If you run Paperclip in any capacity — production, staging, or dev — restrict network access today (VPN, Tailscale, firewall) and upgrade to 2026.416.0 within 3 days per the noisgate mitigation SLA for CRITICAL. A public Metasploit module makes exploitation trivial for anyone who can reach the port. Rotate every API key, cloud credential, and repo token that Paperclip agents had access to — assume they are burned if the instance was ever internet-reachable before patching. Complete the noisgate remediation SLA (full patch rollout across all instances) within 90 days, but frankly, the one-command upgrade (npx paperclipai update) means there is no reason to wait. Monday morning: audit your asset inventory for any Paperclip instance, kill external exposure, patch, rotate secrets, and confirm with the verification script above.

Sources

Peer Review

What defenders are saying.

Submit a review attribution: handle + country only

0 flags selected · stored anonymously

Validation Results

Crowdsourced verification outputs.

Results submitted by users who ran the verification payload against their environment.