CVE-2026-55640

Executive Summary

CVE-2026-55640 is an unauthenticated access control vulnerability in the Nextcloud MCP Server, a production-ready MCP (Model Context Protocol) server that connects AI assistants to Nextcloud instances. Versions prior to 0.117.2 expose the POST /webhooks/nextcloud endpoint without authentication by default, because the WEBHOOK_SECRET environment variable defaults to None and startup validation does not enforce its presence. A network-attacker can exploit this flaw to forge webhook events with an attacker-controlled uid field, enabling deletion or forced re-indexing of vector embeddings for any user and potentially destroying the entire semantic search index. The vulnerability carries a critical CVSS score of 9.1 with high integrity and availability impact.

Organizations running self-hosted Nextcloud instances with the MCP server deployed on network-accessible hosts are affected. AI assistants relying on semantic search over Nextcloud data will experience degraded or complete loss of index functionality. No public exploit, PoC, or CISA KEV listing exists at the time of this report, but the attack requires no authentication and no user interaction, making it highly attractive to opportunistic threat actors.

Technical Analysis

The vulnerability stems from a failure to enforce authentication on the webhook receiver endpoint within the Nextcloud MCP Server. The affected code resides in nextcloud_mcp_server/vector/webhook_receiver.py, specifically the handle_nextcloud_webhook() function, which processes incoming webhook POST requests. The flaw is rooted in the default configuration: the WEBHOOK_SECRET environment variable defaults to None. Although startup validation exists, it does not require the secret to be set, meaning the server can start in an insecure state where authentication checks are effectively disabled.

When WEBHOOK_SECRET is unset, the endpoint accepts unauthenticated requests. The subsequently invoked webhook parser in nextcloud_mcp_server/vector/webhook_parser.py extracts the payload["user"]["uid"] field directly from the incoming JSON body. This field is attacker-controlled and is not cross-validated against an authenticated session. The parsed uid is then used to perform Qdrant vector database operations — specifically deletion or re-indexing of embeddings associated with that user.

The attack surface is the HTTP listening interface of the MCP server. On a typical deployment, this service is bound to a network-accessible address to allow cloud-function integrations or remote clients to post webhook events. Because no authentication is required, the endpooint is effectively publicly reachable and entirely unauthenticated when WEBHOOK_SECRET is unset.

The vulnerability class is CWE-306: Missing Authentication for Critical Function. The mechanism is a classic "trust the webhook payload" failure — the server assumes the webhook originates from an authenticated Nextcloud account and does not independently verify the identity of the caller. By crafting a POST request with a JSON body containing a target user.uid and a deletion event type, an attacker can direct the Qdrant-backed indexing pipeline to remove vector embeddings associated with that user, or trigger a re-indexing operation that may produce corrupted or incomplete embeddings.

The root cause is twofold: (1) insecure default configuration (secret defaults to None), and (2) advisory-only startup validation that allows the server to run without the secret configured. These two issues compound to create an unauthenticated critical endpoint.

Exploitation Scenarios

No public PoC or exploit code exists for this vulnerability. The attack chain below is inferred from the vulnerability class and the technical details supplied in the NVD description.

Step 1 — Reconnaissance / Target Identification:

The attacker performs mass scanning of the internet or internal network for systems exposing the Nextcloud MCP Server's webhook endpoint. Indicators include open ports responding to POST /webhooks/nextcloud paths, Nextcloud MCP-related HTTP titles or banner strings, or Shodan searches targeting common MCP server fingerprinting patterns. The attacker may also probe a discovered Nextcloud instance for the MCP server listening port (often co-deployed or adjacent to the main Nextcloud service).

Step 2 — Triggering the Flaw:

The attacker sends a POST request to http://<target>/webhooks/nextcloud with a JSON body. Because WEBHOOK_SECRET is unset, the handle_nextcloud_webhook() function accepts the request without any authentication checks. The attacker crafts the body such that payload["user"]["uid"] specifies a victim's user identifier or an arbitrary identifier to target.

Step 3 — Payload / Execution Method (vulnerability-class level):

The JSON body includes a webhook event type that instructs the Qdrant indexing pipeline to perform a deletion operation (e.g., an event corresponding to a file deletion, user removal, or metadata change). The uid field is set to the attacker's chosen victim. The webhook_parser.py code extracts this value and passes it, along with the event action, to the Qdrant vector store operations without verifying that the caller is authorized to act on behalf of that user. This triggers deletion of vector embeddings associated with the target user's documents, or forces re-indexing of those documents.

Because the endpoint is unauthenticated, the attacker can repeat this process across multiple users, issuing a flood of forged deletion events targeting every known or guessed uid in the system. The net effect is the systematic destruction of the semantic search index.

Step 4 — Post-Exploitation Impact:

Post-exploitation, the attacker has achieved:

• Integrity impact (High): Deletion or corruption of vector embeddings, making AI-assisted semantic search return incorrect or empty results.
• Availability impact (High): The semantic search index is effectively destroyed. Rebuilding the index requires significant computation and re-processing of all Nextcloud files, causing prolonged downtime for AI assistant features.

The attacker does not gain direct read access to file contents (confidentiality impact is None per the CVSS vector), but the integrity and availability damage is severe. In an enterprise setting, the loss of semantic search cripples productivity tools, AI-driven document discovery, and automation workflows that depend on the MCP server.

Impact Assessment

CVSS Breakdown (from supplied vector): The base score is 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. This reflects a network-exploitable vulnerability requiring no privileges and no user interaction. The scope is unchanged (U), meaning the compromise is limited to the affected component's security authority. Confidentiality impact is none; integrity and availability impact are both high.

Business Impact: Organizations deploying the Nextcloud MCP Server associate it with AI-driven document search, summarization, and retrieval workflows. The ability for an unauthenticated remote attacker to delete or corrupt the entire vector index translates directly into a loss of trust in AI-assisted tools, wasted engineering hours to rebuild the index, and potential reputational damage. For organizations that rely on semantic search for legal, compliance, or knowledge-management purposes, the availability impact is functionally a denial of service.

Affected Systems: Any deployment of Nextcloud MCP Server running version 0.117.1 or earlier, where the server is:

• Exposed directly to the internet,
• Reachable from an internal corporate network but not strictly firewalled to trusted subnets,
• Deployed in a cloud environment with a public or semi-public IP.

The vulnerability is particularly dangerous in default configurations because the insecure setting (WEBHOOK_SECRET = None) is the out-of-box state.

Blast Radius: The Qdrant vector database backing the MCP server stores embeddings for potentially all users of the Nextcloud instance. Therefore, a single exploit attempt can impact the entire user base, not just a single account. The blast radius is organizational-wide when the MCP server serves the whole tenant.

Detection Guidance

The following detection logic targets anomalous or unauthorized access to the POST /webhooks/nextcloud endpoint, particularly requests lacking an authorization header or secret token, and requests exhibiting patterns consistent with mass deletion events.

Sigma Rule

title: Unauthenticated Webhook Access to Nextcloud MCP Server
id: 6a7c3f2e-9b8f-4d1a-8e7c-1a0b2c3d4e5f
status: experimental
description: Detects POST requests to the Nextcloud MCP Server webhook receiver without authentication headers, indicating potential exploitation of CVE-2026-55640.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55640
author: Valters IT Security Team
date: 2026/02/15
tags:
    - attack.t1190
    - cve.2026.55640
logsource:
    category: webserver
    product: nextcloud
    service: mcp_server
detection:
    selection:
        cs-method: POST
        cs-uri-path: /webhooks/nextcloud
    filter_auth:
        cs-headers|contains:
            - 'Authorization:'
            - 'X-Webhook-Secret:'
            - 'X-Api-Key:'
    condition: selection and not filter_auth
falsepositives:
    - Development environments with authentication proxy stripping headers
    - Legacy integrations relying on IP allowlisting
level: high

YARA Rule

rule Nextcloud_MCP_Webhook_Exploit_Attempt
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects HTTP POST payloads targeting the Nextcloud MCP webhook endpoint without authentication tokens"
        cve = "CVE-2026-55640"
        date = "2026-02-15"
        severity = "critical"

    strings:
        $endpoint = "/webhooks/nextcloud" ascii nocase
        $method = "POST" ascii nocase
        $uid_field = "\"user\"" ascii nocase
        $uid_value = "\"uid\"" ascii nocase
        $content_type = "application/json" ascii nocase

    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Nextcloud MCP Server Unauthenticated Webhook Access Attempt (CVE-2026-55640)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webhooks/nextcloud"; nocase; http.request_body; content:"\"uid\""; nocase; content:"\"user\""; nocase; content:"\"delete\""; nocase; reference:cve,2026-55640; classtype:attempted-admin; sid:2026556401; rev:1;)

Elastic Detection

sequence by host.ip, source.ip with maxspan=1m
  [ network where destination.port == 443 and http.request.method == "POST" and
    url.path == "/webhooks/nextcloud" and
    not http.request.headers.authorization != null and
    not http.request.headers.x-webhook-secret != null ]
  [ network where destination.port == 443 and http.request.method == "POST" and
    url.path == "/webhooks/nextcloud" and
    http.request.body.content contains "\"uid\"" and
    http.request.body.content contains "\"delete\"" ]

Splunk SPL Query

index=web earliest=-7d
| where method="POST" 
| where uri_path="/webhooks/nextcloud"
| eval has_auth=if(match(headers,"(?i)Authorization|X-Webhook-Secret|X-Api-Key"),1,0)
| where has_auth=0
| eval body_req=replace(_raw,"\\s+"," ")
| where like(body_req,"%\"uid\"%") OR like(body_req,"%\"user\"%") OR like(body_req,"%\"delete\"%") OR like(body_req,"%\"reindex\"%")
| table _time, src_ip, dest_ip, method, uri_path, headers, body_req
| sort -_time

Wazuh OSSEC Rule

<rule id="100556" level="15">
  <decoded_as>json</decoded_as>
  <field name="method">POST</field>
  <field name="url">/webhooks/nextcloud</field>
  <description>Nextcloud MCP Server webhook request without authentication headers - CVE-2026-55640 exploitation attempt</description>
  <group>web_application_attack,nextcloud,cve_2026_55640,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence has been identified from any tracked source at the time of this report. The NVD description indicates a fix exists in version 0.117.2, but no vendor advisory, commit reference, or release notes have been confirmed by any vulnerability tracking source monitored. Until the patch is formally verified, treat the system as unpatched and apply the following mitigations:

1) Immediate Mitigations (stop the bleeding):

• Restrict network access: Place the MCP server behind a firewall or security group that only allows traffic from trusted IP addresses (e.g., Nextcloud application server, cloud function providers). Deny all inbound traffic to the MCP server listening port from the public internet.
• Set WEBHOOK_SECRET: If the environment variable is supported, configure a strong, random value for WEBHOOK_SECRET and ensure startup validation is updated to require it. Manually verify the server refuses to start without a configured secret.
• Disable the webhook receiver: If the feature is not actively used by AI assistants, disable the endpoint or the entire webhook receiver module via configuration to eliminate the attack surface entirely.
• Rate limit and monitor: Implement a web application firewall (WAF) or reverse proxy rule to rate-limit requests to /webhooks/nextcloud and to alert on requests without Authorization or webhook-secret headers.

2) Patch / Upgrade Steps:

• Monitor the official Nextcloud MCP Server repository (currently no URL confirmed) and apply version 0.117.2 as soon as it is verified. Until then, do not upgrade blindly if the patch introduces breaking changes; test in a staging environment first.
• After upgrading, verify the configuration now enforces WEBHOOK_SECRET at startup and that unauthenticated requests are rejected with an HTTP 401/403 response.

3) Long-term Hardening:

• Adopt a security-in-depth posture for all MCP server deployments: mutual TLS (mTLS) between the webhook sender and receiver, or service-to-service authentication via a sidecar proxy.
• Perform a code review of the webhook_receiver.py and webhook_parser.py modules with a focus on session-vs-payload trust boundaries. Ensure that user-context data (like uid) is cross-validated against the authenticated session whenever possible.
• Integrate the MCP server log stream into SIEM and enable automated alerting on requests matching the detection rules above.
• Subscribe to Nextcloud security advisories and CVE notification feeds to stay informed of the verified patch timeline and any subsequent advisories.

References

1. NVD Entry: CVE-2026-55640 — https://nvd.nist.gov/vuln/detail/CVE-2026-55640
2. CWE-306 Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
3. Nextcloud MCP Server Project (upstream): Monitor the official Nextcloud MCP Server source repository for version 0.117.2 release and patch notes. No direct URL confirmed at time of writing.
4. Qdrant Vector Database Documentation: https://qdrant.tech/documentation/ (for understanding the indexing and deletion operations affected by this vulnerability)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-55640 is NOT listed as of this report date. No evidence of active exploitation in the wild has been observed; no threat actor campaigns are known.