CVE-2026-119713

Paperclip workspace cleanup commands bypass authorization

Paperclip · Paperclip AI-agent orchestration server

First documented disclosure · Review checkpoint

Summary

Agent credentials can turn workspace configuration into server commands.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: A controlled Windows reproduction is documented; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Writable cleanup/teardown commands run through the host shell when a workspace is archived.

Conditions required

An agent API key or other access permitted by the vulnerable configuration; local_trusted mode requires reaching its trusted endpoint.

Potential impact

Execution with the server process’s privileges and access to its files and secrets.

Affected versions and configurations

CNA: @paperclipai/server >=2026.403.0 and <2026.416.0.

Fix and mitigation status

2026.416.0 for this issue.

Practical next steps

Upgrade and restrict who can change executable workspace configuration; isolate the server’s credentials.

Operating lesson

Agent task access must not automatically grant host command configuration.

Evidence and limits

April 16 advisory precedes October 30 CVE publication. CNA score 8.7 models low privileges; advisory prose scores an unauthenticated local_trusted scenario 9.8 under CVSS 3.1. Network exposure cannot be assumed. The advisory has no CVE alias, but the CNA explicitly cites it.

Sources