CVE-2026-41679 - Vulnerability Analysis

Overview

Paperclip < 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.

Mitigation

Update to version 2026.416.0 or later.

References

• https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 23, 2026

🔴 CVE-2026-41679 - Critical (10) Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance runnin... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41679/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

GitHub Repositories(1 repo)

• https://github.com/bartfroklage/cve-2026-41679

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner