Unauthenticated Vector Data Deletion in nextcloud-mcp-server via CVE-2026-55640

The nextcloud-mcp-server application, specifically versions 0.117.1 and earlier, contains a critical authentication bypass vulnerability (CVE-2026-55640). The webhook receiver endpoint at POST /webhooks/nextcloud fails to enforce security checks by default because the WEBHOOK_SECRET configuration variable is not required at startup and defaults to None.

When this secret is unset, the server skips all authentication validation and proceeds to process incoming JSON payloads. An attacker can supply an arbitrary user.uid within the payload, which the server then uses to interact with the backend Qdrant database. This allows unauthorized parties to manipulate or delete vector embeddings associated with any user index. This vulnerability is significant as it requires no prior authentication or system access, and can be used to perform mass-deletion attacks, effectively destroying the semantic search capabilities of the target Nextcloud instance.

Attack Chain

1. Attacker performs network reconnaissance to identify instances of nextcloud-mcp-server listening on port 8000.
2. Attacker verifies the target is running a vulnerable version (<= 0.117.1) where WEBHOOK_SECRET is unset.
3. Attacker crafts a malicious JSON payload formatted as an OCP\Files\Events\Node\BeforeNodeDeletedEvent webhook.
4. Attacker inserts a target user.uid and specific document ID into the JSON payload fields.
5. Attacker sends an unauthenticated POST request to /webhooks/nextcloud targeting the reachable endpoint.
6. The server application accepts the request due to the missing secret validation and passes the attacker-controlled user_id to the Qdrant database client.
7. The Qdrant backend executes the delete operation, removing the specific vector embeddings for the chosen user and document.
8. Attacker repeats this process across multiple document IDs or users to disrupt semantic search services (Denial of Service).

Impact

Successful exploitation allows unauthenticated attackers to delete or corrupt the entire semantic search index for all users within the affected Qdrant instance. This results in a complete loss of search functionality, requiring costly recovery and re-indexing operations. The vulnerability affects any deployment that has not explicitly configured a WEBHOOK_SECRET, which is the default state for the application.

Recommendation

1. Upgrade nextcloud-mcp-server to the latest secure version immediately.
2. Enforce the WEBHOOK_SECRET configuration by adding a validation check in config_validators.py that raises a ConfigurationError if the secret is unset when vector sync is enabled.
3. Update webhook_receiver.py to reject all incoming requests with a 503 or 401 error code if the WEBHOOK_SECRET is not provided and validated via an HMAC-protected Authorization header.
4. Monitor web server logs for high volumes of POST requests to /webhooks/nextcloud originating from untrusted network segments.