Critical Vulnerability Exposes Paperclip Instances to Remote Code Execution Attacks

Summary

Paperclip, a Node.js server and React UI designed for orchestrating AI agents in business operations, has been found vulnerable to a critical unauthenticated remote code execution (RCE) flaw. This vulnerability allows attackers to execute arbitrary commands on any network-accessible Paperclip instance running in authenticated mode with default configuration. The exploit involves a chain of six API calls and requires no user interaction or credentials beyond the target's address. Rapid7 has included this exploit in their Metasploit framework, highlighting its severity and ease of exploitation.

What Happened

The vulnerability, identified as CVE-2026-41679, affects Paperclip instances running versions prior to 2026.416.0. It allows an attacker to perform full remote code execution by exploiting a series of API calls that bypass authentication mechanisms. The attack chain consists of creating an account without verification, generating and approving a CLI challenge for persistent access, and deploying an agent with malicious configuration via import-bypassing the need for instance admin authorization.

Technical Details

The exploit begins with creating a user account on the Paperclip instance without requiring email verification or invite tokens. This is possible due to default configurations that do not enforce strict sign-up restrictions. Following account creation, the attacker generates a CLI authentication challenge and approves it using their own session, granting them a persistent API key.

The critical flaw lies in the import endpoint for creating companies and deploying agents. While direct company creation requires instance admin rights, importing a company does not, allowing attackers to deploy an agent configured to execute arbitrary commands as the server's OS user. This bypass is facilitated by passing unvalidated adapter configurations through the import service.

Affected Products and Fixed Versions

• Product: Paperclip
• Affected Version: Prior to 2026.416.0
• Fixed Version: 2026.416.0

Exploitation Status

The vulnerability has been actively exploited, as evidenced by its inclusion in the Metasploit framework's latest release. This underscores the critical nature of the flaw and the immediate need for affected systems to be patched.

Indicators of Compromise

• Unauthorized creation of user accounts on Paperclip instances.
• Unusual API token generation and approval activities.
• Deployment of new companies with process adapter agents configured to execute arbitrary commands.

Detection Opportunities

Organizations can detect potential exploitation attempts by monitoring for unexpected account creations, CLI challenge approvals without corresponding admin actions, and the import of companies with unusual agent configurations. Implementing strict logging and alerting on these activities can aid in early detection.

Timeline

• May 14: Vulnerability disclosed.
• June 7, 2026: Exploit module added to Metasploit framework by authors Sagilayani and h00die-gr3y.

Why This Matters for Defenders

This vulnerability highlights the critical importance of secure configuration management and the need for rigorous validation of all user inputs and configurations. The ability for an attacker to gain full remote code execution without authentication poses a significant threat, enabling them to access sensitive data, disrupt operations, or pivot to other network services.

What Remains Unclear

While the technical details of the exploit have been disclosed, it remains unclear how widespread the exploitation has been in the wild. Additionally, the specific impact on affected organizations and any potential mitigations beyond patching are not fully documented.

Defender Guidance

Defenders must immediately apply the available patch to version 2026.416.0 or later to mitigate this vulnerability. Organizations should also review their Paperclip configurations to ensure that sign-up is restricted and email verification is enforced for new accounts. Regularly auditing API token generation, approval activities, and company import processes can help detect and prevent exploitation attempts.

A working proof-of-concept is published at https://github.com/sagilayani.