PT-2026-34622 · Paperclip · Paperclip

Sagilayani · Published 2026-04-10 · Updated 2026-04-28 · CVE-2026-41679

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Paperclip versions prior to 2026.416.0

Description An unauthenticated attacker can achieve full remote code execution on any network-accessible instance running in authenticated mode with default configuration. The issue involves an import authorization bypass that allows a chain of six API calls to grant full control over the server operating system. The attack is fully automated and requires no user interaction or credentials.

Recommendations Update to version 2026.416.0.

Exploit

Fix

RCE

Missing Authorization

Improper Authentication

Weakness Enumeration

CWE-862

CWE-287

CWE-1188

Related Identifiers

CVE-2026-41679

GHSA-68QG-G8MG-6PR7

Affected Products

Paperclip

References · 12

• 🔥 https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 · Exploit
• https://osv.dev/vulnerability/GHSA-68qg-g8mg-6pr7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41679 · Security Note
• https://github.com/paperclipai/paperclip · Note
• https://twitter.com/cybrsecpath/status/2048273759694635458 · Twitter Post
• https://twitter.com/jeftovic/status/2047298369949712621 · Twitter Post
• https://twitter.com/CVEnew/status/2047359897403048288 · Twitter Post
• https://twitter.com/CheckmarxZero/status/2047727459945038104 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2047284373699846550 · Twitter Post
• https://twitter.com/cybrsecpath/status/2047363253957988750 · Twitter Post
• https://twitter.com/UpwindMDR/status/2047215961334317533 · Twitter Post
• https://twitter.com/cybrsecpath/status/2048973816618193025 · Twitter Post