OpenClaw Nextcloud Talk CVE-2026-28474

Organizations must be running the optional @openclaw/nextcloud-talk plugin version ≤2026.2.2 (not part of default OpenClaw installation). Exploitation requires: (1) Allowlist-based access controls configured via the allowFrom parameter for DM conversations or room restrictions-default open-access configurations are not vulnerable. (2) Attacker must possess a valid Nextcloud account in the integrated Nextcloud instance to change their display name; purely external attackers cannot exploit this without first compromising or creating a Nextcloud account. (3) The plugin must be actively processing Nextcloud Talk webhook payloads with allowlist validation enabled. Limiting factors: This is not remote unauthenticated exploitation against default configurations-it requires Nextcloud account access and specific allowlist configuration. Organizations not using this optional plugin, running version 2026.2.6+, or operating without allowlist restrictions are not at risk. The CVSS PR:N (no privileges required) rating is misleading; while no privileges are required within the plugin itself, a valid Nextcloud account (which requires user-level privileges in the Nextcloud instance) is a practical prerequisite.

Despite the critical CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact), real-world risk is moderate and highly context-dependent. The CVSS vector indicates network-exploitable, low-complexity attack requiring no privileges or user interaction, which is technically accurate for the plugin's webhook endpoint. However, EPSS score of 0.05% (16th percentile) suggests security researchers and attackers have not prioritized this vulnerability, likely because: (1) it affects only an optional plugin (@openclaw/nextcloud-talk), not the core OpenClaw product, significantly limiting the attack surface; (2) exploitation requires the target organization to have configured allowlists in the first place-default open configurations are unaffected; (3) the attacker must have a valid Nextcloud account in the integrated instance to change display names; and (4) impact is limited to unauthorized conversation access rather than system compromise. The vulnerability is not in CISA KEV, and no public exploit code is confirmed beyond the detailed GitHub advisory and commit diff, which together constitute a functional proof-of-concept. For organizations using allowlist-based access controls with this plugin, this is a critical bypass requiring immediate patching. For organizations not using the Nextcloud Talk plugin or not implementing allowlists, risk is zero. The 18-day window between repository fix (Feb 4) and npm release (Feb 7) created a brief period where source-based deployments were patched but npm users remained vulnerable.

An attacker with a valid Nextcloud account on an integrated instance identifies that a target organization uses OpenClaw with the Nextcloud Talk plugin and has configured allowlists restricting conversation access to specific user IDs (e.g., 'admin' or 'security-team'). The attacker logs into their Nextcloud account, navigates to profile settings, and changes their display name to exactly match an allowlisted user ID string. They then send a message to a restricted DM conversation or room. The vulnerable plugin's allowlist validation performs string equality matching against the attacker-controlled display name, finds a match, and grants access. The attacker can now read and send messages in conversations intended only for authorized personnel, potentially accessing sensitive operational data or injecting malicious instructions.