Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@openclaw/nextcloud-talk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3npmAmendedPublished

    Nextcloud Talk allowlist bypass via actor.name display name spoofing

    CVE-2026-28474 · GHSA-r5h9-vjqc-hq3r

    Affected
    • npm @openclaw/nextcloud-talk <= 2026.2.2
    Fixed in
    2026.2.6· Vendor fix available
    Issue
    In affected versions of the optional Nextcloud Talk plugin (installed separately; not bundled with the core OpenClaw install), an untrusted webhook field (actor.name, display name) could be treated as an allowlist identifier. An attacker could change their Nextcloud display name to match an allowlisted user ID and bypass DM or room allowlists. Details Nextcloud Talk webhook payloads provide a stable sender identifier (actor.id) and a mutable display name (actor.name). In affected versions, the plugin’s allowlist matching accepted equality on the display name, which is attacker-controlled. Affected Packages / Versions - Package: @openclaw/nextcloud-talk (npm) - Affected: <= 2026.2.2 - Fixed: = 2026.2.6 Note: This advisory applies to the optional Nextcloud Talk plugin package. Core openclaw is not impacted unless you installed and use @openclaw/nextcloud-talk. Fix Commit(s) - 6b4b6049b47c3329a7014509594647826669892d Timeline - Introduced:…

    Recommended action: Upgrade to 2026.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →