Paperclip RCE Exposes How Agent Configuration Became Code Execution

Six API Calls to Total Compromise

On August 5, 2026, researchers at Oasis Security disclosed CVE-2026-41679, a CVSS 10.0 unauthenticated remote code execution vulnerability in Paperclip, an open-source agent orchestration platform. The flaw lets an unauthenticated attacker gain full server control via six API calls against any Paperclip instance running in default authenticated mode.

The attack chain is straightforward. An attacker creates an account through Paperclip’s open registration—no email verification required. They sign in, generate a CLI authentication challenge, and self-approve it. No administrative gate intervenes. They then import a malicious agent bundle through the company-import endpoint, which accepts a .paperclip.yaml file specifying a process adapter with an arbitrary bash command. Triggering the agent’s wakeup endpoint causes Paperclip’s spawn() call to execute the attacker’s command as the server’s OS user.

The vulnerability is fully automated. Rapid7 published a Metasploit module shortly after disclosure.

Configuration Is Code

The root cause is architectural. Paperclip’s import system treats agent configuration bundles as trusted instructions rather than executable payloads. As the Oasis Security advisory explains: when you import an agent configuration, you’re not uploading data—you’re instructing Paperclip to create an executable entity that runs shell commands on the server.

This was compounded by an authorization asymmetry. The direct company creation endpoint correctly requires instance-admin privileges. The import endpoint does not: it only checks board-level access for new_company mode. The required assertInstanceAdmin function is not even imported in the route file. Any authenticated user—including one who just self-registered—can import arbitrary agent configurations.

The GitHub advisory packages three vulnerabilities together. Beyond the core RCE, GHSA-xfqj-r5qw-8g4j (CVSS 8.3) exposes forgotten authorization checks on API routes for heartbeat data, agent skill documentation, and deployment health. GHSA-x8hx-rhr2-9rf7 (CVSS 9.6) uses DNS rebinding to bypass localhost isolation in development mode—an attacker-controlled webpage redirects requests to 127.0.0.1 while the browser still treats them as same-origin.

Not an Isolated Failure

Paperclip’s flaw fits a pattern. Configuration endpoints across the agent ecosystem trust and execute user-supplied code. Similar issues have been documented in Flowise (CVE-2025-59528, CVSS 10.0—its CustomMCP node executes JavaScript as part of configuration), LangFlow (CVE-2026-55255, actively exploited), and the Anthropic MCP Inspector (CVE-2025-49596, DNS rebinding).

This is Oasis Security’s second major agent vulnerability disclosure in recent months. The first was OpenClaw/ClawJacked (CVE-2026-25253), a one-click RCE. The common thread: agent onboarding—the process by which platforms ingest and activate external configurations—is the attack surface.

The timing deserves a note. Cyera signed a letter of intent to acquire Oasis Security for approximately $1 billion on July 28, 2026. The Paperclip disclosure followed eight days later. As of the disclosure date, no active exploitation had been confirmed, but the availability of a public Metasploit module lowers the barrier considerably. The EPSS score of 2.951% (86th percentile) suggests the exploit-prediction models are watching.

What Enterprise Teams Should Do Now

Paperclip patched the vulnerability in version 2026.416.0. The mitigations are specific: disable open registration by default, prevent CLI auth self-approval (reject when the approving user is the same user who created the challenge), require email verification, and add the missing assertInstanceAdmin check to the import endpoint.

For enterprise NHI governance teams, the case is a reminder that agent configuration files are not metadata—they are executable declarations. Importing a YAML bundle that specifies a process adapter is functionally equivalent to importing a Dockerfile. Treating either as untrusted input is the starting assumption the industry has not yet internalized.

Patch v2026.416.0 is available. Until platforms move toward sandboxing configuration from execution, the onboarding path remains the most accessible entry point for unauthenticated compromise.