{"uuid": "7fa0dd2e-320d-4552-a794-baa51ffd14ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41679", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/paperclipai_unauth_rce_cve_2026_41679.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"h00die-gr3y \", \"Sagilayani https://github.com/sagilayani\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Paperclip is the operating system for your AI company.\\n          You set the goals, hire AI agents as employees, and watch them plan and execute work.\\n          Prior to version 2026.410.0, Paperclip allows for an unauthenticated RCE, tracked as CVE-2026-41679.\\n          An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip\\n          instance running in authenticated mode with default configuration. The entire chain is six API calls.\", \"disclosure_date\": \"2026-04-10\", \"fullname\": \"exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679\", \"is_install_path\": true, \"mod_time\": \"2026-06-10 20:17:46 +0000\", \"name\": \"Paperclip AI RCE using a chain of six API calls (CVE-2026-41679).\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/paperclipai_unauth_rce_cve_2026_41679.rb\", \"platform\": \"Linux,OSX,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/paperclipai_unauth_rce_cve_2026_41679\", \"references\": [\"CVE-2026-41679\", \"GHSA-GHSA-68qg-g8mg-6pr7\", \"URL-https://attackerkb.com/topics/86rSV7hsXi/cve-2026-41679\"], \"rport\": 3100, \"session_types\": false, \"targets\": [\"Unix/Linux Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:51.472920Z"}