CVE-2026-28474

Executive Summary

CVE-2026-28474 is an allowlist bypass vulnerability in OpenClaw's Nextcloud Talk plugin affecting all versions prior to 2026.2.6. The vulnerability stems from allowlist validation logic that performs equality matching against the actor.name display name field — a mutable, user-controlled attribute — rather than immutable user identifiers. This design flaw enables an attacker with a valid Nextcloud account to alter their display name to match an allowlisted user ID, thereby gaining unauthorized access to direct messages (DMs) and restricted room conversations.

The severity of this vulnerability is critical, with a CVSS score of 9.3, due to the low complexity of exploitation, modest privilege requirements, and broad confidentiality and integrity impact. Affected organizations are those deploying the Nextcloud Talk plugin by OpenClaw within their Nextcloud infrastructure. The vulnerability permits a standard authenticated user to escalate their access to restricted communications channels, potentially exposing sensitive organizational data and enabling further lateral movement within collaborative workflows.

Technical Analysis

The vulnerability resides in the allowlist enforcement mechanism of OpenClaw's Nextcloud Talk plugin. According to the NVD description, the plugin's allowlist validation logic "accept[s] equality matching on the mutable actor.name display name field." This indicates that the authorization check compares the display name of an incoming actor or request directly against entries in an allowlist, rather than comparing against immutable identifiers such as internal user IDs or account UUIDs.

In the Nextcloud ecosystem, the actor.name field represents a user's display name — a profile attribute that users are typically permitted to modify. Nextcloud's display name functionality is designed to be user-editable and can be changed through the user profile settings. The vulnerability is that the plugin's authorization layer trusts this mutable value for security-sensitive allowlist validation.

The attack mechanism is straightforward: an attacker, authenticated as a regular low-privileged user, modifies their display name in their user profile settings to exactly match the user ID (or display name) of an allowlisted user. After the display name change, the plugin's equality-based check treats the attacker's actor identity as authorized, granting access to DMs and room conversations that the attacker should not be able to join.

This is a classic example of authorization bypass via identifier confusion — the system fails to distinguish between a display name (a presentational, mutable attribute) and a persistent user identity (an immutable, system-generated identifier). The vulnerability class is CWE-287 (Improper Authentication), as the flawed allowlist check substitutes a spoofable username for a proper authentication/authorization token.

The attack surface is the Nextcloud Talk plugin's room and DM access control layer. Any endpoint, API call, or inter-process communication path that evaluates allowlist membership for conversation access is potentially affected. Notably, only authenticated users with valid Nextcloud accounts can exploit this — the attack requires a low-privilege valid account. However, given that Nextcloud instances often permit self-registration in enterprise deployments or have many low-privilege accounts, the practical attack surface is broad.

This vulnerability shares characteristics with other display name spoofing issues in collaboration platforms, where the gap between presentational user-facing names and security-critical identity tokens is insufficiently enforced.

Exploitation Scenarios

Note: No public PoC is available at the time of writing; the attack chain below is inferred from the vulnerability class and the information provided in the NVD description.

Step 1 — Reconnaissance / Target Identification The attacker begins by identifying a Nextcloud instance running the OpenClaw Nextcloud Talk plugin prior to version 2026.2.6. Reconnaissance may involve scanning for Nextcloud login pages, enumerating user lists through public shares, or leveraging OpenClaw-specific exposed endpoints. The attacker then creates an account on the target instance (if self-registration is enabled) or compromises an existing low-privilege account. The attacker identifies a target allowlisted user — typically someone whose display name or user ID is discoverable via shared files, public chats, or user enumeration on the Nextcloud instance.

Step 2 — Triggering the Flaw Class The attacker authenticates into the Nextcloud instance using their valid low-privilege account. The attacker then edits their personal profile settings, changing their display name to exactly match the allowlisted target user's ID or display name. For example, if the target user's allowlist entry is alice.smith, the attacker sets their display name to alice.smith. The attacker does not need to guess any authentication credentials — only the display name string.

Step 3 — Payload / Execution Method (Vulnerability-Class Level) With the spoofed display name in place, the attacker waits for the profile change to propagate through the system. The attacker then initiates a request to join a restricted room or DM conversation. The OpenClaw plugin's allowlist validation logic performs an equality comparison between the actor's actor.name (now set to alice.smith) and the allowlist entries (containing alice.smith). Since the comparison passes, the plugin grants the attacker access to the restricted conversation. This is performed over the standard web interface or Talk API — no custom tooling is required beyond standard HTTP requests to the Nextcloud endpoint.

Step 4 — Post-Exploitation Impact Once inside the restricted conversation, the attacker gains access to sensitive communications content: private messages, shared files, calendar details, and discussion threads intended only for the allowlisted user's group. The attacker can read messages, exfiltrate attached files, and potentially post messages or modify shared documents, thereby compromising the integrity of the communication channel. The attacker could additionally map internal project relationships, identify further high-value targets, or impersonate the allowlisted user in future phishing attempts against other team members.

Impact Assessment

Business Impact: The CVSS score of 9.3 categorizes this as a critical vulnerability. The attack requires network access and a valid low-privilege Nextcloud account but demands no user interaction and no special conditions; the attack complexity is low. The scope is changed (AV:N/AC:L/PR:L/UI:N/S:C), meaning a compromise in the Talk plugin can affect resources beyond the plugin's security boundary — in this case, sensitive organizational communications residing in Nextcloud Talk rooms.

Confidentiality Impact — High: The attacker gains unauthorized read access to restricted DMs and rooms, exposing sensitive business communications, internal decision-making, and potentially regulated personal data.

Integrity Impact — High: The attacker can send messages in the compromised conversations, edit shared documents, and potentially delete or modify content, eroding trust in the communication channel's authenticity.

Affected Systems: Any Nextcloud deployment running the OpenClaw Nextcloud Talk plugin version prior to 2026.2.6. The vulnerability is agent-agnostic within that scope — any user with a valid account on the affected instance is a potential attacker.

Blast Radius: The blast radius is contained to the Nextcloud instance's Talk conversations but extends logically to any sensitive data shared through those channels. In organizations that use Talk for incident coordination, financial discussions, or legal matters, the exposure could have cascading consequences beyond the communication platform itself. The EPSS score (0.00489, 39.5th percentile) suggests that active exploitation is not yet widespread, but the vulnerability's low exploitation barrier suggests the score could rise rapidly once a PoC circulates.

Availability Impact — None: The vulnerability does not directly impact system availability.

Detection Guidance

Detection of this vulnerability is challenging because the exploitation itself is largely silent over the network — the attacker simply changes a profile attribute and joins a room. The most effective detection surfaces are (a) user profile modification audit logs and (b) authorization decision logs within the Talk plugin. The rules below are designed to detect anomalies in these areas.

Sigma Rule

title: OpenClaw Nextcloud Talk Allowlist Bypass via Display Name Spoofing
id: 5f4b4dc6-77e4-11ef-9e2a-0242ac120002
status: experimental
description: Detects rapid user display name changes in Nextcloud that may indicate allowlist bypass attempts via CVE-2026-28474
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28474
author: Valters IT Threat Intel
date: 2026/02/12
logsource:
    product: nextcloud
    service: audit
detection:
    selection_display_name_change:
        event_type: 'user_update'
        field_modified:
            - 'displayname'
    selection_username_change_correlation:
        event_type: 'user_update'
        field_modified:
            - 'displayname'
    condition: selection_display_name_change
    timeframe: 10m
    condition: selection_display_name_change and selection_username_change_correlation
falsepositives:
    - Legitimate users changing their display names for professional reasons
    - HR or admin operations updating user profiles
level: medium

YARA Rule

rule Detect_Nextcloud_AllowlistBypass_DisplayNameSpoof
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects Nextcloud user profile API responses showing display name modification consistent with CVE-2026-28474 exploitation"
        cve = "CVE-2026-28474"
        date = "2026-02-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28474"
    strings:
        $s1 = "displayname" ascii nocase
        $s2 = "user_update" ascii nocase
        $s3 = "actor.name" ascii nocase
        $s4 = "user_id" ascii nocase
        $a1 = "settings/user" ascii nocase
        $a2 = "PUT" ascii nocase
    condition:
        uint16(0) == 0x5B7B or uint16(0) == 0x7B0A or (filesize < 300KB and
        (all of ($s*) and any of ($a*)))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT OpenClaw Nextcloud Talk Allowlist Bypass Display Name Spoofing Attempt"; flow:established,to_server; content:"/ocs/v2.php/cloud/users/"; http.uri; content:"PUT"; http.method; content:"displayname"; http.request_body; pcre:"/key[\"']?\s*:\s*[\"']displayname[\"']/i"; fast_pattern; metadata:created_at 2026_02_12, updated_at 2026_02_12, former_category EXPLOIT, cve CVE-2026-28474; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-28474; sid:30000001; rev:1;)

Elastic Detection

sequence with maxspan=15m
  [ audit where event.action == "user_update" and
    user.name != "*bot*" and
    event.outcome == "success"
  ] by user.id
  [ audit where event.action == "talk_room_join" and
    event.outcome == "success" and
    // Flag joins to rooms with restricted membership
    user.name in allowlisted_users_list
  ] by user.id

Note: allowlisted_users_list would need to be defined as an Elastic list containing known allowlisted user IDs for the organization's Talk plugin.

Splunk SPL Query

index=nextcloud sourcetype=nextcloud:audit
| search event_type="user_update" OR event="user_update"
| spath output=field_modified path=field_modified{}
| search field_modified="displayname"
| eval changed_displayname=mvindex('user.displayname', -1)
| table _time, user, changed_displayname, ip
| join type=inner user [ 
    search index=nextcloud sourcetype=nextcloud:audit 
    | spath output=room_id path=room_id
    | search event_type="talk_room_join"
    | table user, room_id, _time
    | eval join_time=_time
  ]
| where (join_time - _time) < 600
| stats count by user, changed_displayname, room_id

Wazuh OSSEC Rule

<group name="nextcloud,">
  <rule id="100230" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">user_update</field>
    <field name="field_modified">displayname</field>
    <description>OpenClaw Nextcloud Talk: User display name changed - potential allowlist bypass (CVE-2026-28474)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_failed,</group>
  </rule>

  <rule id="100231" level="15">
    <decoded_as>json</decoded_as>
    <field name="event_type">user_update</field>
    <field name="field_modified">displayname</field>
    <description>OpenClaw Nextcloud Talk: Repeated display name changes by same user - possible CVE-2026-28474 exploitation</description>
    <same_source_ip />
    <field name="occurrences">3</field>
    <group>authentication_failed,</group>
    <if_sid>100230</if_sid>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. A single source (OSV) indicates that a fix is available in version 2026.2.6. This has not been independently confirmed by the vendor or additional third-party sources as of this report. Treat all operational decisions with appropriate caution and verify patch availability directly.

1) Immediate Mitigations (apply until the vendor patch is verified and deployed):

• Restrict Display Name Modification: In Nextcloud's server configuration, consider limiting which users can modify their display names. If possible, disable self-service display name editing temporarily or restrict it to administrators only.
• Enforce User ID vs. Display Name Separation: Audit any custom configurations to ensure that allowlists reference immutable user IDs rather than display names where possible.
• Monitor Audit Logs: Activate enhanced audit logging for profile changes and room join events. Correlate these events as described in the Detection Guidance section for early warning.
• Restrict Self-Registration: If the instance allows open registration, disable it or restrict it to trusted domains to reduce the pool of potential attackers.
• Least-Privilege Review: Review the allowlist configurations in the OpenClaw Talk plugin to identify any rooms that contain highly sensitive data; consider whether their accessibility is appropriate.

2) Patch/Upgrade Steps:

• Verify the availability of OpenClaw Nextcloud Talk version 2026.2.6 from official OpenClaw distribution channels.
• Before upgrading, back up the Nextcloud database and configuration files.
• Apply the upgrade following the vendor's standard upgrade procedure for Nextcloud apps.
• After upgrade, verify the Talk plugin version is 2026.2.6 or later in the Nextcloud admin Apps settings.
• Perform a functional test: change a test user's display name to match an allowlisted user, then confirm that the test user can no longer access restricted rooms.
• Monitor the vendor's official channels for independent confirmation of the patch.

3) Long-Term Hardening:

• Identity Policy: Establish a policy that authorization decisions (allowlists, access control) must always reference immutable account identifiers, never mutable display attributes. Document this in secure coding guidelines for internal plugin development.
• Configuration Review: Regularly audit all authorization-related configurations in the Talk plugin and custom integrations.
• Security Testing: Include display name spoofing and identifier confusion attacks in periodic penetration tests of the Nextcloud environment.
• Patch Management: Subscribe to OpenClaw's security announcement channels to ensure patching within 48 hours of critical disclosures.

References

1. NVD Entry for CVE-2026-28474: https://nvd.nist.gov/vuln/detail/CVE-2026-28474
2. OSV Database Entry for CVE-2026-28474 (patch source): https://osv.dev/vulnerability/CVE-2026-28474
3. MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
4. CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html

Known Exploitation Campaigns: As of this report's publication, there is no known active exploitation in the wild, no CISA KEV listing, no public PoC, no Nuclei template, and no exploit code available. The EPSS score of 0.00489 (39.5th percentile) indicates a low current probability of exploitation, though this is subject to change once proof-of-concept code or detailed technical write-ups surface. Note that the absence of public evidence does not preclude targeted or unpublished exploitation; organizations running affected versions should treat this as an urgent patching priority given the critical severity score.