CVE-2026-55640: nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.7%, percentile 54: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 54% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes nextcloud-mcp-server (PyPI) <= 0.117.1, fixed in 0.117.2. Check your lockfile, including transitive dependencies.

What it is

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup validation does not require it. When WEBHOOKSECRET is unset, handlenextcloudwebhook() accepts unauthenticated requests. The payload["user"]["uid"] field parsed in nextcloudmcpserver/vector/webhookparser.py is attacker-controlled and is used without an authenticated-session cross-check for Qdrant operations, allowing a network attacker to delete or trigger re-indexing of vector embeddings for any user and to destroy the semantic search index by sending forged deletion events. This issue is fixed in version 0.117.2.

From the GitHub advisory

Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.

Details Vulnerable file: nextcloudmcpserver/vector/webhookreceiver.py, function handlenextcloudwebhook(), lines 55-67

Root cause 1: Auth check is guarded by if secret: - skipped entirely when WEBHOOKSECRET is unset.

Root cause 2: webhooksecret: str | None = None in config - no startup validator enforces it, even when vector sync is enabled.

Trusted field: payload["user"]["uid"] in webhookparser.py is used as-is for all Qdrant operations - no cross-check against an authenticated session.

Weakness type: CWE-306.

Product: nextcloud-mcp-server (PyPI) · Assigned by: GitHub_M · Published: 2026-08-25

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
• FIRST EPSS (model of 2026-10-21): 0.73% probability of exploitation activity in the next 30 days; percentile 54.

Timeline

• 2026-08-25 — CVE record last updated
• 2026-08-25 — CVE record published by GitHub_M
• 2026-08-25 — GitHub-reviewed advisory GHSA-8vh3-g2qg-2h2c published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-8vh3-g2qg-2h2c github.com
2. CVE.org record CVE-2026-55640 cve.org
3. NVD entry CVE-2026-55640 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com

Critical PyPI advisories · Today’s Security Digest