CVE-2026-55640
Received Received - Intake

Unauthenticated Webhook Handling in Nextcloud MCP Server

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud_mcp_server/vector/webhook_receiver.py has no authentication by default because WEBHOOK_SECRET defaults to None and startup validation does not require it. When WEBHOOK_SECRET is unset, handle_nextcloud_webhook() accepts unauthenticated requests. The payload["user"]["uid"] field parsed in nextcloud_mcp_server/vector/webhook_parser.py is attacker-controlled and is used without an authenticated-session cross-check for Qdrant operations, allowing a network attacker to delete or trigger re-indexing of vector embeddings for any user and to destroy the semantic search index by sending forged deletion events. This issue is fixed in version 0.117.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55640
EUVD
EUVD-2026-65596

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cbcoutinho nextcloud_mcp_server 0.117.2
nextcloud nextcloud_mcp_server 0.117.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Nextcloud MCP Server before version 0.117.2. The POST /webhooks/nextcloud endpoint lacks authentication because the WEBHOOK_SECRET defaults to None and is not enforced at startup. Attackers can send unauthenticated requests with a forged user ID in the payload, which is used to delete or re-index vector embeddings in Qdrant without validation.

Detection Guidance

Check if the Nextcloud MCP Server is running without authentication by verifying if the WEBHOOK_SECRET environment variable is set. Inspect the server logs for unauthenticated POST requests to /webhooks/nextcloud. Use curl to test the endpoint: curl -X POST http://<server>:8000/webhooks/nextcloud -H 'Content-Type: application/json' -d '{"user":{"uid":"test"}}' to see if it accepts requests without a secret.

Impact Analysis

An attacker could delete or corrupt your vector embeddings, destroying the semantic search index. This requires only network access to port 8000 and could lead to data loss or service disruption. The impact includes loss of search functionality and potential exposure of sensitive data if embeddings are tampered with.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or corruption, violating integrity and availability requirements in GDPR and HIPAA. Loss of semantic search data may also impact data processing agreements, potentially leading to compliance breaches and regulatory penalties.

Mitigation Strategies

Immediately set the WEBHOOK_SECRET environment variable to a strong, unique value and restart the Nextcloud MCP Server. Ensure all instances enforce this secret for webhook authentication. Update to version 0.117.2 or later where webhooks require authentication by default.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55640. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart