Search: CVE-2026-41679

CVE-2026-41679 is a critical improper authentication vulnerability in Paperclip, a Node.js server and React UI platform for orchestrating AI agents. Prior to version 2026.416.0, an unauthenticated attacker can remotely execute arbitrary code on any network-accessible Paperclip instance running in authenticated mode with default configuration. The attack requires no user interaction or credentials and involves a chain of six API calls. The vulnerability is patched in version 2026.416.0.