PT-2026-34622 · Paperclip · Paperclip
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Paperclip versions prior to 2026.416.0
Description
An unauthenticated attacker can achieve full remote code execution on network-accessible instances running in
authenticated mode with default configuration. The attack is fully automated, requires no user interaction or credentials, and involves a chain of six API calls. The issue stems from an import authorization bypass that allows an attacker to create a company and deploy an agent using a process adapter, which executes arbitrary commands via the spawn() function without sandboxing.Technical details of the exploitation chain include:
- Creating an account via the
/api/auth/sign-up/emailendpoint, which is open by default. - Generating and self-approving a CLI authentication challenge via
/api/cli-auth/challengesand/api/cli-auth/challenges/<id>/approveto obtain a persistent API key. - Bypassing authorization at the
/api/companies/importendpoint to create a new company and configure a malicious agent adapter. - Triggering the malicious agent via the
/api/agents/<agent-id>/wakeupendpoint to execute commands as the server's OS user.
Recommendations
Update Paperclip to version 2026.416.0.
As a temporary mitigation, restrict access to the
/api/companies/import endpoint.
Disable open registration by setting the PAPERCLIP AUTH DISABLE SIGN UP environment variable to true.
Require email verification for new accounts.Exploit
Fix
RCE
Improper Authentication
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Paperclip