www.oasis.security Critical Vulnerabilities in Paperclip AI Platform Enable Unauthenticated Command Execution
Article Content
- •Three critical vulnerabilities in Paperclip allow unauthenticated command execution.
- •CVE-2026-41679 has a maximum CVSS score of 10.0, indicating severe risk.
- •All vulnerabilities have been patched in the latest releases of Paperclip.
Oasis Security identified three critical vulnerabilities in the Paperclip AI agent platform, allowing unauthenticated attackers to execute arbitrary commands on servers and developer machines. The flaws stem from a design oversight in authorization checks, particularly in the self-registration process and company import workflows. An attacker could create an account without email verification, gain board-level API access, and exploit the system to run malicious commands. The vulnerabilities include CVE-2026-41679, which has a CVSS score of 10.0, and other issues that expose sensitive API endpoints. All vulnerabilities were patched in versions 2026.416.0 and 0.3.1. The findings highlight systemic failures in how AI agent control systems manage identity boundaries, posing risks beyond just Paperclip.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (12)
Following this threat?
Track Paperclip and CVE-2026-41679 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Exploited On September 14, 2026, Cisco disclosed a critical SQL injection vulnerability (CVE-2026-76461) in its Secure Email Gateway, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. This vulnerability arises from insufficient validation in the email parsing logic. Cisco confirmed… 
Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…