{"id":"CVE-2026-41208","revision":null,"records":[{"revision":"e8a3b656f0744beb8cbb528343903c83","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41208","aliases":[],"title":"Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution","description":"Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime. As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. @paperclipai/server version 2026.416.0 fixes the issue.","state":0,"publishedAt":"2026-04-23T00:47:45.824+00:00","modifiedAt":"2026-04-23T14:46:01.107+00:00","affected":[{"ecosystem":"Vendor product","name":"@paperclipai/server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"paperclipai\",\n                    \"product\": \"@paperclipai/server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2026.416.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/paperclipai/paperclip/security/advisories/GHSA-265w-rf2w-cjh4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41208","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41208","identifiers":["CVE-2026-41208"]},"retained":false,"historicalAffected":[]},{"revision":"437c80515f014a3f8b9319c3402598d5","observedAt":"2026-11-01T07:06:05.355+00:00","statement":{"source":"euvd","id":"EUVD-2026-25162","aliases":["CVE-2026-41208"],"title":"Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API k…","description":"Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime. As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. @paperclipai/server version 2026.416.0 fixes the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":null}],"references":["https://github.com/paperclipai/paperclip/security/advisories/GHSA-265w-rf2w-cjh4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25162","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 23, 2026, 12:47:45 AM","dateUpdated":"Apr 23, 2026, 2:46:01 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-25162","identifiers":["EUVD-2026-25162","CVE-2026-41208"]},"retained":false,"historicalAffected":[]},{"revision":"e4c67e3a3b834dbfb0e6f016bc1e3e78","observedAt":"2026-10-27T10:10:07.342+00:00","statement":{"source":"nvd","id":"CVE-2026-41208","aliases":[],"title":"Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API k…","description":"Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime. As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. @paperclipai/server version 2026.416.0 fixes the issue.","state":0,"publishedAt":"2026-04-23T02:16:18.67+00:00","modifiedAt":"2026-10-26T22:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/paperclipai/paperclip/security/advisories/GHSA-265w-rf2w-cjh4"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41208","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-78"],"productCriteria":["cpe:2.3:a:paperclip:paperclipai:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-04-23T02:16:18.670","lastModified":"2026-10-26T22:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41208","identifiers":["CVE-2026-41208"]},"retained":false,"historicalAffected":[]},{"revision":"d4c934a3dc4d47c092fb61db2baed8be","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-265w-rf2w-cjh4","aliases":["CVE-2026-41208"],"title":"Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution","description":"### Summary\nPaperclip contains a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host.\nAn attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host.\nThe vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint.\nThe configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime using:\n```\nspawn(\"/bin/sh\", [\"-c\", command])\n```\nAs a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning.\nThis breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system.\nThis vulnerability allows remote code execution on the server host.\n\n### Details\n#### Rootcause \nAgent configuration can be modified through the API endpoint:\n```\nPATCH /api/agents/:id\n```\nThe validation schema allows arbitrary configuration fields:\n```\nadapterConfig: z.record(z.unknown())\n```\nThis allows attackers to inject arbitrary keys into the adapter configuration object.\nLater, during workspace provisioning, the server runtime executes a shell command derived directly from this configuration.\nRelevant code path:\n```\nserver/src/services/workspace-runtime.ts\n\nadapterConfig.workspaceStrategy.provisionCommand\n        ↓\nprovisionExecutionWorktree()\n        ↓\nrunWorkspaceCommand(...)\n        ↓\nspawn(\"/bin/sh\", [\"-c\", input.command])\n```\nExample logic:\n```\nconst provisionCommand = asString(input.strategy.provisionCommand, \"\").trim()\n\nawait runWorkspaceCommand({\n  command: provisionCommand\n})\n```\nInside runWorkspaceCommand the command is executed using:\n```\nspawn(shell, [\"-c\", input.command])\n```\nBecause no validation, escaping, or allowlist is applied, attacker-controlled configuration becomes a direct OS command execution primitive.\n\n\n#### Affected Files\n```\nserver/src/services/workspace-runtime.ts\n```\nFunctions involved:\n```\nrealizeExecutionWorkspace()\nprovisionExecutionWorktree()\nrunWorkspaceCommand()\n```\n\n#### Attacker Model\nRequired privileges:\nAttacker needs:\n```\nAgent API key\n```\nThis credential is intended for agent automation and should not grant host-level execution privileges.\nAgent credentials may also be exposed to external runtimes, plugins, or third-party agent providers. Allowing such credentials to configure host-executed commands creates a privilege escalation vector.\nNo board or administrator access is required.\n\n#### Attacker Chain\nComplete exploit chain:\n```\nAttacker obtains Agent API key\n        ↓\nPATCH /api/agents/:id\n        ↓\nInject adapterConfig.workspaceStrategy.provisionCommand\n        ↓\nPOST /api/agents/:id/wakeup\n        ↓\nServer executes workspace provisioning\n        ↓\nworkspace-runtime.ts\n        ↓\nspawn(\"/bin/sh -c\")\n        ↓\nArbitrary command execution on server host\n```\n\n#### Trust Boundary Violation\nPaperclip’s architecture assumes the following separation:\n```\nAgent runtime\n        ↓\nPaperclip control plane\n        ↓\nServer host OS\n\nAgents should only perform workflow automation tasks through the orchestration layer.\n\nHowever, because agent-controlled configuration is executed directly by the server runtime, the boundary collapses:\n\nAgent configuration\n        ↓\nServer command execution\n```\nThis allows an agent to execute commands outside its intended permissions.\n\n#### Why This Is a Vulnerability (Not Expected Behavior)\nThe provisionCommand field appears intended for trusted operators configuring workspace strategies.\nHowever, the current API design allows agents themselves to modify this configuration.\nBecause agent credentials are designed for automation and may be exposed to agent runtimes, plugins, or external providers, allowing them to configure commands executed by the host introduces a privilege escalation vector.\nTherefore:\n```\nOperator-controlled configuration → expected feature\nAgent-controlled configuration → privilege escalation vulnerability\n```\nThe vulnerability arises from insufficient separation between configuration authority and execution authority.\n\n### PoC\nThe following PoC demonstrates safe command execution by writing a marker file on the server.\nThe PoC does not modify system state beyond creating a file.\n\n#### Step 1 — Setup Environment\nRun Server:\n```\n$env:SHELL = \"C:\\Program Files\\Git\\bin\\sh.exe\"\nnpx paperclipai onboard --yes\n```\n<img width=\"1444\" height=\"699\" alt=\"image\" src=\"https://github.com/user-attachments/assets/44401c6d-ec73-4e59-943a-8635d5115c2c\" />\n\nLogin Claude:\n```\nclaude\n/login\n```\n\n#### Step 2 — Obtain Agent API key\nCreate an agent via the UI or CLI and obtain its API key.\nExample:\n```\npcp_xxxxxxxxxxxxxxxxxxxxx\n```\n<img width=\"1457\" height=\"670\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bb1ab898-cf0b-47b1-865a-127ba6fdc43c\" />\n\n#### Step 3 — Identify agent ID\n```\nGET /api/agents/me\n```\n<img width=\"1463\" height=\"639\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cadea916-9e57-4cf4-a11c-7320a22c4ab6\" />\n\n#### Step 4 — Inject malicious configuration\n```\nPATCH /api/agents/{agentId}\n```\n<img width=\"1476\" height=\"697\" alt=\"image\" src=\"https://github.com/user-attachments/assets/612f7a16-b6d6-418e-bcbe-ce602b711b14\" />\nPayload:\n```\nPS E:\\BucVe\\pocrepo> $patchBody = @{\n>>   adapterConfig = @{\n>>     workspaceStrategy = @{\n>>       type = \"git_worktree\"\n>>       provisionCommand = \"echo PAPERCLIP_RCE > poc_rce.txt\"\n>>     }\n>>   }\n>> } | ConvertTo-Json -Depth 10\n```\n\n#### Step 5 — Trigger execution\n```\nPOST /api/agents/{agentId}/wakeup\n```\n<img width=\"1472\" height=\"675\" alt=\"image\" src=\"https://github.com/user-attachments/assets/268c7322-a5f5-4f3a-a4d4-b43efbecb20e\" />\n\n#### Step 6 — Verify command execution\n<img width=\"1231\" height=\"347\" alt=\"image\" src=\"https://github.com/user-attachments/assets/559c483b-077e-42dd-9309-6a5e5c6a3bdc\" />\nThe marker file appears on the server filesystem:\n```\n~/.paperclip/worktrees/.../poc_rce.txt\n```\nExample content:\n```\nPAPERCLIP_RCE\n```\nThis confirms that attacker-controlled commands executed on the server.\n\n### Impact\nSuccessful exploitation allows:\n```\nRemote command execution on the Paperclip server\n```\nPotential attacker actions:\n```\nread environment variables\nexfiltrate secrets\nmodify repositories\naccess database credentials\nexecute reverse shells\npersist on host\n```\nBecause Paperclip orchestrates multiple agents and repositories, this can lead to full compromise of the deployment environment.\nThis effectively allows a malicious agent to escape the orchestration layer and execute arbitrary commands on the server host.\n\n### Recommended Fix\n1. Restrict configuration authority\nAgents should not be able to modify execution-sensitive configuration fields.\nExample mitigation:\n```\ndeny adapterConfig.workspaceStrategy modification from agent credentials\n```\n2. Server-side allowlist\nOnly allow trusted configuration keys.\nExample:\n```\nadapterConfig.workspaceStrategy.provisionCommand\n\nshould only be configurable by board/admin actors.\n```\n3. Avoid shell execution\nInstead of:\n```\nspawn(\"/bin/sh\", [\"-c\", command])\n```\nprefer:\n```\nspawn(binary, args)\n```\nor a restricted command runner.\n\n4. Input validation\nReject commands containing shell operators:\n```\n|\n&\n;\n$\n`\n```\n5. Sandboxed workspace execution\nWorkspace provisioning should run in a restricted environment (container / sandbox).\n\n### Minimal Patch Suggestion\nOne possible mitigation is to prevent agent principals from modifying execution-sensitive configuration fields such as `workspaceStrategy.provisionCommand`.\nFor example, during agent configuration updates, the server can explicitly reject this field when the request is authenticated using an Agent API key.\nExample TypeScript guard:\n\n```ts\n// reject agent-controlled provisionCommand\nif (\n  request.auth?.principal === \"agent\" &&\n  body?.adapterConfig?.workspaceStrategy?.provisionCommand\n) {\n  throw new Error(\n    \"Agents are not permitted to configure workspaceStrategy.provisionCommand\"\n  );\n}\n```\nAdditionally, the server should avoid executing arbitrary shell commands derived from configuration values.\nInstead of executing:\n```\nspawn(\"/bin/sh\", [\"-c\", command])\n```\nprefer structured execution:\n```\nspawn(binary, args)\n```\nor restrict the command to a predefined allowlist.\n\n### Security Impact Statement\nAn authenticated attacker with an Agent API key can modify their agent configuration to inject arbitrary shell commands into `workspaceStrategy.provisionCommand`. These commands are executed by the Paperclip server during workspace provisioning via `spawn(\"/bin/sh\", [\"-c\", command])`, resulting in arbitrary command execution on the host system.\n\n### Disclosure\nThis vulnerability was discovered during security research on the Paperclip orchestration runtime.\nThe issue is reported privately to allow maintainers to patch before public disclosure.","state":0,"publishedAt":"2026-04-16T22:45:26+00:00","modifiedAt":"2026-05-05T16:11:42.991053+00:00","affected":[{"ecosystem":"npm","name":"@paperclipai/server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2026.416.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/paperclipai/paperclip/security/advisories/GHSA-265w-rf2w-cjh4","https://nvd.nist.gov/vuln/detail/CVE-2026-41208","https://github.com/paperclipai/paperclip"],"sourceUrl":"https://github.com/advisories/GHSA-265w-rf2w-cjh4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-265w-rf2w-cjh4","identifiers":["GHSA-265w-rf2w-cjh4","CVE-2026-41208"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T14:57:20.8260435+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T14:57:20.8260435+00:00","lastSuccessAt":"2026-11-01T14:57:20.9959229+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:57:20.9959241+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-d531ae12fd03a30fe810f370dfdaee6d5ce6932749e1e8d224c6f881789a42e1","complete":true,"records":417653,"lastAttemptAt":"2026-11-01T14:57:20.4936635+00:00","lastSuccessAt":"2026-11-01T14:57:20.4630684+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:57:20.4936635+00:00","snapshotPublishedAt":"2026-11-01T14:28:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7a3763b612e249af8e21823e33cbf35e","complete":false,"records":13568,"lastAttemptAt":"2026-11-01T15:09:18.8870785+00:00","lastSuccessAt":"2026-11-01T15:09:18.883+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:09:18.883+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13449,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T14:57:20.8260435+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T14:57:20.8260435+00:00","lastSuccessAt":"2026-11-01T14:57:20.9969402+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:57:20.9969412+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-6f777ca48c9f4a26b09cd3abcf1e29ef","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T14:57:28.522156+00:00","lastSuccessAt":"2026-11-01T14:57:28.517+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:57:28.517+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T14:57:20.7705737+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:57:20.7705737+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T14:57:20.5439977+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:57:20.5439977+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T14:57:20.7877402+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:57:20.7877402+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-55acacd40a7aab88cf530cfddf98233a5d800cfc6bb1883653ecf5bee50f4426","complete":true,"records":230996,"lastAttemptAt":"2026-11-01T14:57:20.6511816+00:00","lastSuccessAt":"2026-11-01T09:06:49.6961926+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:57:20.6511816+00:00","snapshotPublishedAt":"2026-11-01T08:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}