PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-77087 paperclipai CVE debrief

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. This vulnerability enables malicious actors to craft webpages that, when visited by developers running Paperclip locally, can make authenticated API requests and execute commands through the process adapter, potentially leading to unauthorized access and data breaches. Affected organizations should prioritize updating to version 0.3.1 or later, review and validate Host headers in configurations, and monitor for suspicious activity related to DNS rebinding attacks.

Vendor
paperclipai
Product
paperclip
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-21
Original CVE updated
2026-08-21
Advisory published
2026-08-21
Advisory updated
2026-08-21

Who should care

Developers and administrators using Paperclip, especially those running it in local_trusted mode, should be aware of this vulnerability and take steps to mitigate it. Affected operators, platforms, and security teams should review the vulnerability details and plan for remediation. Vulnerability management and security teams should prioritize updating Paperclip to version 0.3.1 or later.

Technical summary

The Paperclip application before version 0.3.1, when running in default local_trusted mode, does not properly validate Host headers. This vulnerability allows attackers to execute arbitrary commands via DNS rebinding attacks. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter. Developers using Paperclip should update to version 0.3.1 or later to address the vulnerability.

Defensive priority

Developers using Paperclip should update to version 0.3.1 or later to address the vulnerability.

Recommended defensive actions

  • Update Paperclip to version 0.3.1 or later
  • Review and validate Host headers in Paperclip configurations
  • Monitor for suspicious activity related to DNS rebinding attacks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was created based on information from the NVD and other sources. The details of the vulnerability are limited, and further investigation is needed to fully understand the impact. Defenders should verify the affected scope, severity, and vendor guidance. The vulnerability allows attackers to execute arbitrary commands via DNS rebinding attacks. Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-21T15:16:47.290Z and has not been modified since then.