Overview
- Researchers found three related authorization and access-control flaws that let attacker-supplied agent configuration reach Paperclip’s host-level execution adapter and run commands with the service account’s privileges.
- The worst flaw, CVE-2026-41679, allowed an unauthenticated actor to self-register, self-approve a CLI authorization challenge, obtain a board-level API key, import a crafted .paperclip.yaml bundle, and trigger server-side command execution.
- A DNS-rebinding weakness in Paperclip’s default local_trusted mode let a malicious webpage pivot into localhost and call the import and wakeup APIs to run commands on a developer’s machine without tokens or stolen credentials.
- Paperclip maintainers published fixes in tagged code that enforces import authorization and hostname validation (tagged v2026.416.0 with internal manifests labeled 0.3.1), but public advisory and version-label inconsistencies and a public Metasploit module raise immediate exploitability concerns.
- Operators should upgrade to the patched tag, restrict who can import bundles, enable hostname validation for local deployments, audit open registration and API exposure, and rotate service credentials because successful attacks can expose repositories, local secrets, and internal services.