Description
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud_mcp_server/vector/webhook_receiver.py has no authentication by default because WEBHOOK_SECRET defaults to None and startup validation does not require it. When WEBHOOK_SECRET is unset, handle_nextcloud_webhook() accepts unauthenticated requests. The payload["user"]["uid"] field parsed in nextcloud_mcp_server/vector/webhook_parser.py is attacker-controlled and is used without an authenticated-session cross-check for Qdrant operations, allowing a network attacker to delete or trigger re-indexing of vector embeddings for any user and to destroy the semantic search index by sending forged deletion events. This issue is fixed in version 0.117.2.
Published: 2026-08-25
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Data Loss and Denial of Service
Action: Patch Immediately
AI Analysis

Impact

The vulnerability is an unauthenticated POST endpoint that lets an attacker control the payload used for deletion commands against the vector store, causing removal or re‑indexing of vector embeddings for any user and the destruction of the semantic search index. This leads to permanent data loss and service interruption, as indicated by the CVSS score of 9.1.

Affected Systems

The affected product is Nextcloud MCP Server from cbcoutinho, versions earlier than 0.117.2. The fix is implemented starting in 0.117.2, so any installation running a lower version is vulnerable.

Risk and Exploitability

The EPSS score is not available, but the high CVSS score and lack of authentication mean that a network attacker can simply send an unauthenticated POST request to the /webhooks/nextcloud endpoint. The likely attack vector is over the network to the exposed webhook URL, with no credentials required. As the vulnerability is not listed in the CISA KEV catalog, there is no known widespread exploitation yet, but the potential impact warrants immediate attention.

Generated by OpenCVE AI on August 25, 2026 at 21:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to version 0.117.2 or later provided by cbcoutinho to conceal the POST endpoint behind authentication.
  • If an upgrade is delayed, set the WEBHOOK_SECRET environment variable to a strong secret so that the endpoint requires authentication before processing requests.
  • As a temporary measure, restrict external access to the /webhooks/nextcloud endpoint using firewall or network ACLs to limit exposure to trusted hosts.

Generated by OpenCVE AI on August 25, 2026 at 21:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8vh3-g2qg-2h2c nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
History

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Cbcoutinho
Cbcoutinho nextcloud-mcp-server
Vendors & Products Cbcoutinho
Cbcoutinho nextcloud-mcp-server

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Description Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud_mcp_server/vector/webhook_receiver.py has no authentication by default because WEBHOOK_SECRET defaults to None and startup validation does not require it. When WEBHOOK_SECRET is unset, handle_nextcloud_webhook() accepts unauthenticated requests. The payload["user"]["uid"] field parsed in nextcloud_mcp_server/vector/webhook_parser.py is attacker-controlled and is used without an authenticated-session cross-check for Qdrant operations, allowing a network attacker to delete or trigger re-indexing of vector embeddings for any user and to destroy the semantic search index by sending forged deletion events. This issue is fixed in version 0.117.2.
Title Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Cbcoutinho Nextcloud-mcp-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T19:20:43.689Z

Reserved: 2026-06-16T23:52:12.057Z

Link: CVE-2026-55640

cve-icon Vulnrichment

Updated: 2026-08-25T18:38:43.180Z

cve-icon NVD

Status : Deferred

Published: 2026-08-25T16:16:55.810

Modified: 2026-09-09T21:07:31.353

Link: CVE-2026-55640

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:36:56Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function