GHSA-47wq-cj9q-wpmp: Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys

Summary

The Paperclip agent routes POST, GET and DELETE on /api/agents/:id/keys (server/src/routes/agents.ts, lines 2050-2087) call only assertBoard and never assertCompanyAccess, so any authenticated board user can mint a plaintext pcp_* agent API token for an agent in any company. The token is bound to the victim agent's companyId, which lets an attacker perform operations inside the victim tenant. The same assertBoard-only pattern appears on the pause, resume, terminate and delete agent handlers.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumFake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents EarlySimilar attack · The Hacker News
• MediumRansomware extortion gets personal as attackers target employees’ familiesSimilar attack · CSO Online
• MediumLangflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsSimilar attack · The Hacker News
• MediumAnthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatSimilar attack · Dark Reading
• HighCVE-2026-104103: Ludwig archive extraction allows writes outside extraction directorySimilar attack · NVD/CVE Database