CVE-2026-41208 - Vulnerability Analysis

Overview

Paperclip @paperclipai/server < 2026.416.0 contains a privilege escalation caused by improper validation of adapterConfig in /agents/:id API, letting attackers with Agent API keys execute arbitrary OS commands on the server host, exploit requires attacker to have an agent credential.

Severity & Score

Impact

Attackers with agent credentials can execute arbitrary OS commands on the server host, leading to full server compromise.

Mitigation

Upgrade to version 2026.416.0 or later.

References

• https://github.com/paperclipai/paperclip/security/advisories/GHSA-265w-rf2w-cjh4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner