{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nextcloud-mcp-server/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-55640"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nextcloud-mcp-server"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Nextcloud"],"content_html":"\u003cp\u003eThe \u003ccode\u003enextcloud-mcp-server\u003c/code\u003e application, specifically versions 0.117.1 and earlier, contains a critical authentication bypass vulnerability (CVE-2026-55640). The webhook receiver endpoint at \u003ccode\u003ePOST /webhooks/nextcloud\u003c/code\u003e fails to enforce security checks by default because the \u003ccode\u003eWEBHOOK_SECRET\u003c/code\u003e configuration variable is not required at startup and defaults to \u003ccode\u003eNone\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eWhen this secret is unset, the server skips all authentication validation and proceeds to process incoming JSON payloads. An attacker can supply an arbitrary \u003ccode\u003euser.uid\u003c/code\u003e within the payload, which the server then uses to interact with the backend Qdrant database. This allows unauthorized parties to manipulate or delete vector embeddings associated with any user index. This vulnerability is significant as it requires no prior authentication or system access, and can be used to perform mass-deletion attacks, effectively destroying the semantic search capabilities of the target Nextcloud instance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify instances of \u003ccode\u003enextcloud-mcp-server\u003c/code\u003e listening on port 8000.\u003c/li\u003e\n\u003cli\u003eAttacker verifies the target is running a vulnerable version (\u0026lt;= 0.117.1) where \u003ccode\u003eWEBHOOK_SECRET\u003c/code\u003e is unset.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious JSON payload formatted as an \u003ccode\u003eOCP\\Files\\Events\\Node\\BeforeNodeDeletedEvent\u003c/code\u003e webhook.\u003c/li\u003e\n\u003cli\u003eAttacker inserts a target \u003ccode\u003euser.uid\u003c/code\u003e and specific document ID into the JSON payload fields.\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003e/webhooks/nextcloud\u003c/code\u003e targeting the reachable endpoint.\u003c/li\u003e\n\u003cli\u003eThe server application accepts the request due to the missing secret validation and passes the attacker-controlled \u003ccode\u003euser_id\u003c/code\u003e to the Qdrant database client.\u003c/li\u003e\n\u003cli\u003eThe Qdrant backend executes the delete operation, removing the specific vector embeddings for the chosen user and document.\u003c/li\u003e\n\u003cli\u003eAttacker repeats this process across multiple document IDs or users to disrupt semantic search services (Denial of Service).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to delete or corrupt the entire semantic search index for all users within the affected Qdrant instance. This results in a complete loss of search functionality, requiring costly recovery and re-indexing operations. The vulnerability affects any deployment that has not explicitly configured a \u003ccode\u003eWEBHOOK_SECRET\u003c/code\u003e, which is the default state for the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade \u003ccode\u003enextcloud-mcp-server\u003c/code\u003e to the latest secure version immediately.\u003c/li\u003e\n\u003cli\u003eEnforce the \u003ccode\u003eWEBHOOK_SECRET\u003c/code\u003e configuration by adding a validation check in \u003ccode\u003econfig_validators.py\u003c/code\u003e that raises a \u003ccode\u003eConfigurationError\u003c/code\u003e if the secret is unset when vector sync is enabled.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003ewebhook_receiver.py\u003c/code\u003e to reject all incoming requests with a 503 or 401 error code if the \u003ccode\u003eWEBHOOK_SECRET\u003c/code\u003e is not provided and validated via an HMAC-protected Authorization header.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for high volumes of \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/webhooks/nextcloud\u003c/code\u003e originating from untrusted network segments.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-25T18:48:33Z","date_published":"2026-08-25T18:48:33Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nextcloud-mcp-server-auth-bypass/","summary":"An unauthenticated remote attacker can delete or corrupt semantic search vector embeddings in Qdrant by sending a crafted POST request to the /webhooks/nextcloud endpoint due to missing default authentication.","title":"Unauthenticated Vector Data Deletion in nextcloud-mcp-server via CVE-2026-55640","url":"https://feed.craftedsignal.io/briefs/2026-08-nextcloud-mcp-server-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Nextcloud-Mcp-Server","version":"https://jsonfeed.org/version/1.1"}