CVE-2026-41679

Katalog CVE

CVSS 10.0 · Critical EPSS 7,4%

Kerentanan Improper Authentication pada paperclipai, paperclipai/server. Skor CVSS 3.1 10.0 (Critical) menurut github.com.

Deskripsi (NVD)

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.

Rincian

Terbit di NVD

23 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-862: Missing Authorization
CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

7,4% peluang dieksploitasi; lebih tinggi dari 94,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 exploit · mitigasi · advisory pihak ketiga