critical · 9.1CVE-2026-55640Aug 25, 2026

CVE-2026-55640: nextcloud-mcp-server Unauthenticated Webhook Allows Arbitrary Vector Data Deletion

Rohit Hatagale
AI Security Researcher, SecureLayer7

Any unauthenticated attacker who can reach port 8000 can send a crafted POST to the Nextcloud webhook endpoint and delete any user's semantic search index in Qdrant, because the server ships with no…

Packagenextcloud-mcp-server
Ecosystempip
Affected<= 0.117.1
Fixed in0.117.2
CVE-2026-55640: nextcloud-mcp-server Unauthenticated Webhook Allows Arbitrary Vector Data Deletion

The problem

The POST /webhooks/nextcloud endpoint in webhook_receiver.py skips authentication entirely when WEBHOOK_SECRET is not set, which is the default. The if secret: guard means the Bearer-token check is simply never reached on a stock deployment.

The user_id is read directly from the attacker-supplied JSON field payload["user"]["uid"] without any server-side identity check. An attacker can supply any victim username and trigger Qdrant delete operations for that user's entire vector embedding collection.

Proof of concept

A working proof-of-concept for CVE-2026-55640 in nextcloud-mcp-server, with the exact payload below.

http
POST /webhooks/nextcloud HTTP/1.1
Host: target:8000
Content-Type: application/json

{
  "event": {
    "class": "OCP\\Files\\Events\\Node\\BeforeNodeDeletedEvent",
    "node": { "path": "/victim/files/Notes/any.md", "id": 12345 }
  },
  "user": { "uid": "victim" },
  "time": 0
}

The root cause is a missing-authentication design flaw (CWE-306). The auth check is wrapped in if secret:, so when webhook_secret is None (the default), the entire check is skipped and the request is processed with only a log warning. Because payload["user"]["uid"] is trusted as-is in webhook_parser.py, the attacker fully controls which Qdrant collection is targeted.

The patch (commit 4fc2b10) fixes this in two places: webhook_receiver.py now returns HTTP 503 immediately when no secret is configured, and config_validators.py raises a startup error if vector sync is enabled without a secret. This converts a silent runtime bypass into a hard fail at startup.

The fix

Upgrade to nextcloud-mcp-server 0.117.2. If you cannot upgrade immediately, set the WEBHOOK_SECRET environment variable to a strong random value. The patched version refuses to start with vector sync enabled and no secret configured, and returns HTTP 503 on the webhook endpoint if the secret is missing at runtime.

Reporter not attributed.

References: [1][2][3][4]

Related research