CVE-2026-77087

CriticalCVSS 9.6/10Last modified Oct 15, 2026

Description

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2026
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-770886.1justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to accountCVE-2026-770899.8Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenanCVE-2026-77096.3A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cpCVE-2026-770908.7CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolvCVE-2026-770917.8DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance releaseCVE-2026-770929.8Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolvedCVE-2026-770937.1CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all CVE-2026-770947.1CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. SoftwareCVE-2026-770957.1CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. UpdaCVE-2026-770967.7CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. CVE-2026-770978.2Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. SoftwarCVE-2026-770989.8Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenanc
CVE-2026-77087: Critical severity, CVSS 9.6 | Vulnix