Paperclip AI Agent Platform — CVE-2026-41679

Paperclip is a self-hosted, open-source control plane for teams of AI agents. In its default configuration it allows anyone to self-register an account, and a newly registered user can self-approve their own CLI authorization challenge to mint a persistent board-level API credential without any independent approver. That board-level credential is enough to reach the company-import route — which, unlike direct company creation, was never restricted to instance administrators. An attacker imports a company bundle defining an agent whose adapter type is process (Paperclip's built-in command executor), wakes the agent, and Paperclip spawns the attacker's chosen command with the OS privileges of the Paperclip server process. The whole chain is six unauthenticated API calls end to end, Rapid7 shipped a public Metasploit module for it in June 2026, and CISA's SSVC enrichment marks it automatable with total technical impact.

Two related flaws disclosed in the same Oasis Security report reach the identical outcome (attacker-controlled agent configuration reaching the host execution adapter) through different trust failures: a DNS-rebinding attack against Paperclip's local_trusted developer mode (GHSA-x8hx-rhr2-9rf7, CVSS 9.6, drive-by RCE against a developer's own machine via a malicious webpage — no credentials required), and a set of API routes that omitted authentication or company-scoping checks entirely (GHSA-xfqj-r5qw-8g4j, CVSS 8.3, information disclosure and reconnaissance). All three share one root cause Oasis calls out explicitly: "agent configuration must be treated as executable input." Paperclip fixed all three in v2026.416.0 (server manifest 0.3.1).

The attack chain up through "agent woken" lives entirely in Paperclip's own application and audit logs — self-registration, self-approval, and company import are not Falcon-visible events. Everything from the moment the process adapter calls spawn() onward — the attacker's command executing as a child of the Paperclip server process, and whatever it does next — is fully visible to Falcon EDR and is where this pack's detection coverage concentrates.

Six sources fetched and saved verbatim to Paperclip-CVE-2026-41679-Hunt-sources/. No embedded instructions directed at an AI agent were found in any fetched page; all content was treated as data, not directions. One note on internal consistency: The Hacker News's own review found Paperclip uses two version labels for the same tagged release — the GitHub security-release tag is v2026.416.0 while the in-tag server/CLI manifests report 0.3.1 — which is why sources reference both. The GHSA-x8hx-rhr2-9rf7 (DNS-rebinding) advisory still lists no formal patched-version field even though the fix is present in the same tagged source; treat v2026.416.0/0.3.1 as the safe upgrade target for all three findings.

Not fully corroborated / used with caution: the exact default network port Paperclip listens on is not stated consistently across sources reviewed — CQL queries in this pack deliberately do not hard-code a port and instead surface all external connections/listeners for the analyst to scope to their own deployment's configured port.

Hunt hypotheses

1. Process-adapter abuse (high confidence). If CVE-2026-41679 has been exploited, the Paperclip server process (a Node.js process) will have spawned an unexpected shell or interpreter as a direct child — the process adapter calls spawn() with zero sandboxing on the attacker-supplied command.
2. Reverse-shell delivery (high confidence). The simplest payload for a six-call automated chain is a reverse shell; command lines spawned from the Paperclip process tree containing shell-redirect-to-network or interpreter-socket patterns are high-signal.
3. Post-RCE discovery and credential access (high confidence). The disclosed proof-of-concept itself runs id and whoami as its verification step — expect discovery commands as the first post-exploitation action, followed by credential-file reads if the operator pivots.
4. Persistence via the compromised service account (medium-high confidence). An attacker with arbitrary command execution as the Paperclip server's OS user will typically establish a foothold beyond the single RCE — registry Run-key/Asep entries (Windows) or cron/systemd/SSH-key changes (Linux, only partially Falcon-visible via command line).
5. Outbound C2/exfil (medium confidence, needs tuning). A spawned child process reaching out to a non-private destination shortly after being spawned by the Paperclip process tree is consistent with C2 callback or exfiltration, but Paperclip's own legitimate LLM-API/package-registry traffic will need to be excluded.
6. Internet exposure as a leading indicator (low confidence, exposure signal only). Any Paperclip instance accepting inbound connections from the public internet on its authenticated-mode listener is, by definition, in the vulnerable population before considering registration settings — useful for prioritization, not for confirming compromise.

Attack chain

This CVE is an authorization-logic bug in an open-source application, not a payload family — there are no published file hashes or C2 domains/IPs to ship as atomic detect/block indicators. The table below lists the identifiers actually published (CVE/advisory IDs, affected package versions, the vulnerable configuration default, and the public exploit tooling), all of which trace to the saved source snapshots — see §10 for the import-ready quick-copy blocks and §15/exec-summary for the honest coverage-gap statement.

The API-level attack chain — self-registration, self-approval, import, wake — is not visible to Falcon. It lives entirely in Paperclip's own application/audit log (and, for the DNS-rebinding path, in browser/DNS telemetry Falcon also does not natively collect). These checks require pulling Paperclip's own logs; they are the highest-signal detections for this specific chain and should run alongside the CQL queries in §8, not instead of them.

• Self-approval velocity. Query Paperclip's audit log for accounts where the same actor identity both created and approved a CLI authorization challenge, especially within minutes of account registration. In legitimate operation a CLI challenge is approved by a different, already-trusted user.
• Import target-mode by role. Flag any company-import event with target.mode = new_company initiated by an actor whose role is board-level rather than instance-administrator — this is the exact authorization mismatch CVE-2026-41679 exploited, and it is a clean, low-noise signal once the app-log field is available.
• Wake-immediately-after-import. Flag agent "wake" events occurring within seconds to low minutes of the company import that created the agent, particularly when the agent's adapter type is process. Legitimate operator workflows rarely wake a freshly imported agent instantly.
• Registration configuration audit. Confirm the deployment's PAPERCLIP_AUTH_DISABLE_SIGN_UP setting. If it is unset or false, open self-registration is active — treat as a standing finding regardless of patch level, since open registration is the enabling condition for step 1 even after the import-route fix closes the RCE path.
• Deployment-mode audit. Confirm the instance is not running local_trusted mode anywhere reachable by more than a single trusted developer on a single machine. If it must run in local_trusted, confirm the version is v2026.416.0+ so the private-hostname/DNS-rebinding guard is active.
• Version/patch-status check. Query the instance's own health/version endpoint (or CLI/manifest version) and confirm it reports v2026.416.0 or server-manifest 0.3.1 or later. See the audit commands in §10 and §13.

Promote to a Custom IOA only after the baseline period in §11. Recommended promotion order:

Q3, Q4, Q6, Q7, Q8 remain hunt/investigate-only given their FP profile (medium-high) and, for Q7/Q8, their role as exposure/context signals rather than confirmed-compromise signals.

No file hashes, C2 domains, or C2 IPs have been published for this CVE — it is an authorization-logic bug in application code, not a payload family. The blocks below ship the identifiers that are published (CVE/advisory IDs, affected package/version range, the vulnerable config default, and public exploit tooling), plus behavioral signatures and a patch/config audit checklist, in place of a conventional hash/domain blocklist.

type,value,action,severity,expiration,description,tags
cve,CVE-2026-41679,enrich,critical,2027-02-11,Paperclip import authorization bypass RCE,vuln:paperclip
advisory,GHSA-68qg-g8mg-6pr7,enrich,critical,2027-02-11,GitHub technical advisory for CVE-2026-41679,vuln:paperclip
advisory,GHSA-x8hx-rhr2-9rf7,enrich,high,2026-11-11,DNS-rebinding drive-by RCE against local_trusted mode,vuln:paperclip
advisory,GHSA-xfqj-r5qw-8g4j,enrich,medium,2026-11-11,Missing authorization on several API routes,vuln:paperclip
package,@paperclipai/server,enrich,critical,2027-02-11,npm package - vulnerable below v2026.416.0,vuln:paperclip
package,paperclipai,enrich,critical,2027-02-11,npm package - vulnerable below v2026.416.0,vuln:paperclip
config-key,PAPERCLIP_AUTH_DISABLE_SIGN_UP,enrich,high,2026-11-11,defaults false - open self-registration enabling condition,vuln:paperclip
exploit-module,linux/http/paperclipai_unauth_rce_cve_2026_41679,pivot,high,2026-09-11,public Rapid7 Metasploit module - six-call automated chain,vuln:paperclip

# Behavioral signal, not an atomic indicator -- pair with Q1-Q8 in section 8
Parent process:    node | paperclip | paperclip-server | npm | npx | pm2 | docker-entrypoint.sh
Unexpected child:  bash | sh | dash | zsh | cmd.exe | powershell.exe | pwsh | python | perl | ruby | nc | ncat | socat
Reverse-shell cmd: /dev/tcp/ redirection, "nc -e", interpreter socket one-liners, hidden-window PowerShell
Discovery cmd:     whoami, id, uname -a, hostname, ip a, ifconfig, netstat, cat /etc/passwd
Persistence:       Registry Run/RunOnce key write from the same process tree
Network:           outbound connection to a non-private address opened by a Paperclip-tree child process

CVE-2026-41679                              (CVSS 10.0 - unauthenticated RCE, primary)
GHSA-68qg-g8mg-6pr7                          (CVE-2026-41679 technical advisory)
GHSA-x8hx-rhr2-9rf7                          (CVSS 9.6  - DNS rebinding, local_trusted mode)
GHSA-xfqj-r5qw-8g4j                          (CVSS 8.3  - missing route authorization)
linux/http/paperclipai_unauth_rce_cve_2026_41679   (public Rapid7 Metasploit module)

# 1. Confirm patched version (target: v2026.416.0 / server manifest 0.3.1, or later)
curl -sk https://REPLACE_WITH_HOST/api/health | grep -i version

# 2. Confirm open self-registration is disabled (or explicitly accepted risk)
#    Check the deployment's environment for:
PAPERCLIP_AUTH_DISABLE_SIGN_UP=true

# 3. Confirm deployment mode is not local_trusted on any shared/networked host
#    (local_trusted should be single-developer, single-machine only)

# 4. Confirm the instance is not directly internet-reachable without a
#    VPN / SSO / IP-allowlist in front of it

Playbook A — Verify patch status and disable open self-registration

Prerequisites: shell access to the host running Paperclip; ability to restart the Paperclip service.
Reboot required: no (service restart only).
Rollback: revert the environment variable change and restart the service; this re-enables open self-registration and returns to prior behavior — only roll back if you have an alternative registration control in place.

# 1. Check current version against the fixed release
curl -sk https://REPLACE_WITH_HOST/api/health | grep -i version
# Expect: v2026.416.0 / server manifest 0.3.1, or later

# 2. If you cannot patch immediately, disable open self-registration in the
#    Paperclip environment configuration (.env, docker-compose.yml, or the
#    orchestrator's secret/config store):
PAPERCLIP_AUTH_DISABLE_SIGN_UP=true

# 3. Restart the Paperclip service to apply
docker compose restart paperclip-server   # or: systemctl restart paperclip-server

Playbook B — Remove direct internet exposure (reverse proxy + firewall)

Prerequisites: nginx (or equivalent reverse proxy) already provisioned in front of the host; firewall management access (ufw/iptables/security group).
Reboot required: no.
Rollback: remove the added firewall DROP/allowlist rule and the proxy auth block to restore prior (direct) access — only do this in a controlled maintenance window, since it restores the exposed condition.

# nginx: require a client certificate or upstream SSO auth in front of Paperclip
location / {
    # Require your SSO/OAuth2 proxy or mTLS client cert here before proxying
    auth_request /oauth2/auth;
    proxy_pass http://127.0.0.1:REPLACE_WITH_PAPERCLIP_PORT;
}

# Host firewall: only allow the reverse proxy / VPN subnet to reach the
# Paperclip port directly; deny everything else
ufw deny REPLACE_WITH_PAPERCLIP_PORT/tcp
ufw allow from REPLACE_WITH_TRUSTED_SUBNET to any port REPLACE_WITH_PAPERCLIP_PORT proto tcp

Playbook C — Sandbox the service (systemd hardening, if not containerized)

Prerequisites: Paperclip runs as a systemd service unit; systemd 245+.
Reboot required: no (daemon-reload + service restart).
Rollback: remove the added directives from the unit override file and run systemctl daemon-reload && systemctl restart paperclip-server to restore prior (unsandboxed) behavior.

# /etc/systemd/system/paperclip-server.service.d/hardening.conf
[Service]
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/paperclip
CapabilityBoundingSet=
User=paperclip-svc
Group=paperclip-svc

# Apply:
sudo systemctl daemon-reload
sudo systemctl restart paperclip-server

Playbook D — Container security options (if running via Docker)

Prerequisites: Docker/Compose-managed deployment; ability to recreate the container.
Reboot required: no (container recreate only — expect a brief service interruption during recreate).
Rollback: remove the added security_opt/cap_drop/read_only lines from the compose file and re-run docker compose up -d to restore the prior container configuration.

# docker-compose.yml
services:
  paperclip-server:
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    user: "REPLACE_WITH_NON_ROOT_UID:REPLACE_WITH_NON_ROOT_GID"

# Apply:
docker compose up -d --force-recreate paperclip-server

See §11 for the validation-gate sequence (telemetry readiness → benign baseline → positive test → promotion) that must be completed before any query above moves from hunt/investigate to a live Custom IOA.

Verbatim fetched text of all 6 sources saved to Paperclip-CVE-2026-41679-Hunt-sources/. No embedded AI-directed instructions were found in any source; all fetched content was treated as data, not directions, per standing policy.