CVE-2026-77164

Executive Summary

CVE-2026-77164 is a blind server-side request forgery (SSRF) vulnerability in the Nextcloud Circles app. The remote-instance signature verification routine fetches an attacker-supplied keyId URL before trust in the remote instance is established, and explicitly permits local and private address ranges for that request — thereby bypassing Nextcloud's core SSRF protections. Two public, unauthenticated endpoints (POST /apps/circles/event/ and POST /apps/circles/incoming/) reach this code path, allowing any unauthenticated network-reachable user to force the Nextcloud server to issue a GET request to an arbitrary internal address. The impact is limited to blind SSRF — reachability/discovery of internal services — because the response body is never returned to the requester; confidentiality impact is rated High (C:H) in the supplied CVSS vector, but integrity and availability are unaffected.

Technical Analysis

Nextcloud's Circles app implements federated "circles" (trusted groups of Nextcloud instances). A core part of federation is signature verification: when one instance receives a request from a remote instance, it must validate the cryptographic signature of that request. To do so, the receiving instance fetches the remote party's public key from a URL identified by a keyId value supplied in the incoming request.

The vulnerability arises from the ordering and scoping of that fetch:

1. Ordering failure — fetch before trust. The remote-instance signature verification logic fetches the keyId URL before trust in the remote instance has been established. In a correct federation implementation, the key retrieval should either occur only for already-trusted peers, or the target address should be validated against a strict allowlist/denylist prior to any outbound request. Because the fetch happens pre-trust, the keyId value is fully attacker-controlled and is dereferenced without a trust gate.

2. Scoping failure — SSRF protections bypassed. Nextcloud core implements SSRF protections that block outbound requests to local and private address ranges (loopback, RFC 1918, link-local, etc.). The Circles code path explicitly allows local/private addresses for this request, which bypasses those core protections. This is the operative defect: the framework's guard rails are intentionally disabled for a request whose destination is attacker-chosen.

3. Unauthenticated reachability. The vulnerable code path is reachable from two endpoints that are described as public and unauthenticated:

   • POST /apps/circles/event/
   • POST /apps/circles/incoming/

   Any user who can reach the Nextcloud instance over the network can supply an attacker-controlled keyId and trigger the server-side GET, with no authentication or prior federation relationship required.

4. Blind SSRF semantics. The response body of the internal request is never returned to the requester. Therefore the attacker cannot exfiltrate internal service response contents through this endpoint alone. What the attacker can do is induce the server to make a request to an internal address and observe timing/side-channel behavior to infer whether an internal service is reachable (port/service discovery). This is classic blind SSRF.

Vulnerability class: CWE-918 — Server-Side Request Forgery (SSRF). The distinguishing characteristic here is not the SSRF primitive itself but the deliberate disabling of the platform's SSRF mitigations for a pre-trust, attacker-controlled URL fetch.

The NVD description does not disclose the specific function, method, or class names in the Circles codebase, nor the exact internal URL validation code. No further code-level detail is available from the supplied data, and this report does not infer or fabricate implementation specifics beyond the keyId parameter, the two endpoint paths, and the behaviors explicitly stated in the description.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None; Nuclei template: NO). The attack chain below is inferred from the vulnerability class (SSRF via pre-trust attacker-controlled URL fetch) and the facts stated verbatim in the NVD description. No specific function names, internal file paths, or parameters beyond keyId, POST /apps/circles/event/, and POST /apps/circles/incoming/ are asserted.

Step 1 — Reconnaissance / target identification. The attacker identifies a reachable Nextcloud instance with the Circles app enabled. Because the two endpoints are public and unauthenticated, no credentials are required. Reconnaissance is limited to confirming the instance exposes the Circles routes.

Step 2 — Triggering the flaw class. The attacker sends an unauthenticated POST request to POST /apps/circles/event/ or POST /apps/circles/incoming/, constructing the request such that it reaches the remote-instance signature verification path. That path requires a keyId value identifying where the remote instance's public key should be fetched from. The attacker sets keyId to a URL pointing at an internal or private address (e.g., a loopback address, an RFC 1918 address, or a link-local/metadata-style address).

Step 3 — Payload/execution at the vulnerability-class level. The Nextcloud server, executing the signature-verification fetch, issues a GET request to the attacker-supplied keyId URL. Because the code path explicitly allows local/private addresses, the platform's core SSRF protections do not block the request. The request is server-originated, so it traverses the internal network from the Nextcloud host's network position.

Step 4 — Post-exploitation impact. The response body is not returned to the attacker; this is blind SSRF. The attacker observes indirect signals (response timing, error behavior, connection outcomes) to determine whether a targeted internal address/port is reachable. The realistic outcome is internal service/port enumeration and network topology inference from the vantage point of the Nextcloud server. Direct response-content exfiltration is not possible through this endpoint alone. CVSS integrity and availability subscores are N — the flaw does not modify data or disrupt availability.

Impact Assessment

CVSS v3.0: 6.2 — CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Subscore interpretation:

• AV:L (Local): The vector rates the attack as local. This reflects the scoring context in the supplied data; note that the endpoints are described as network-reachable and unauthenticated, so any environment where a hostile party has local or adjacent access can exercise the flaw.
• AC:L (Low): No special conditions or race windows are required; the attacker simply supplies a crafted keyId.
• PR:N / UI:N: No privileges and no user interaction — the endpoints require neither auth nor a victim click.
• S:U (Unchanged): Impact is confined to the vulnerable component's security scope.
• C:H (High confidentiality): The flaw permits inference of internal network/service reachability (information disclosure via blind SSRF).
• I:N / A:N: No integrity or availability impact.

Business impact. A Nextcloud instance is frequently deployed at the network perimeter or in a DMZ, where it has broad reachability into internal services. Blind SSRF from that vantage point is a reconnaissance and pivot enabler: an unauthenticated attacker can map internal services and identify reachable internal endpoints. It does not, per the description, yield direct data theft through this endpoint alone, but it materially reduces the effort required for subsequent targeted attacks. Cloud-hosted Nextcloud instances are of particular concern because instance metadata endpoints are classic SSRF targets.

Blast radius. Any internet- or network-exposed Nextcloud deployment with the Circles app where these endpoints are reachable. Because the trigger is unauthenticated, every exposed instance is a candidate. CISA KEV status: NO — no evidence of exploitation in the wild is provided in the supplied data, and this report does not assert any.

Detection Guidance

The rules below target the behavior of exploitation — outbound requests to private/loopback addresses and anomalous use of the Circles federation endpoints. Signatures are crafted from the endpoints and keyId parameter named in the NVD description. Field names not present in the description are not asserted; rules match request path and the keyId parameter generically.

Sigma Rule

title: Potential CVE-2026-77164 Nextcloud Circles Blind SSRF
id: 9d1c9f3a-7a41-4c8e-9c2b-3f6b2a10e7d1
status: experimental
description: Detects requests to Nextcloud Circles federation endpoints associated with the keyId-based blind SSRF in CVE-2026-77164.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77164
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.918
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem:
      - '/apps/circles/event/'
      - '/apps/circles/incoming/'
  selection_keyid:
    cs-uri-query|contains: 'keyId='
  condition: selection_path and selection_keyid
falsepositives:
  - Legitimate federated Circles synchronization between trusted instances
level: medium

YARA Rule

rule CVE_2026_77164_Nextcloud_Circles_SSRF
{
    meta:
        author = "valtersit.com"
        description = "Detects request payloads abusing the Nextcloud Circles keyId signature-verification SSRF (CVE-2026-77164)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77164"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ep1 = "/apps/circles/event/"
        $ep2 = "/apps/circles/incoming/"
        $keyid = "keyId="
        $k_local1 = "keyId=http://127.0.0.1"
        $k_local2 = "keyId=https://127.0.0.1"
        $k_local3 = "keyId=http://localhost"
        $k_local4 = "keyId=http://169.254.169.254"
        $k_priv1 = "keyId=http://10."
        $k_priv2 = "keyId=http://192.168."
        $k_priv3 = "keyId=http://172.1"
        $k_priv4 = "keyId=http://172.2"
        $k_priv5 = "keyId=http://172.3"

    condition:
        (any of ($ep1, $ep2)) and (
            any of ($k_local1, $k_local2, $k_local3, $k_local4, $k_priv*) or
            ($keyid and 1 of them)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77164 Nextcloud Circles blind SSRF via keyId to private address"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/apps/circles/"; http.uri; content:"keyId="; pcre:"/keyId=https?:\/\/(127\.0\.0\.1|localhost|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|\[::1\])/Ui"; classtype:attempted-recon; reference:cve,2026-77164; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77164; sid:202677164; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method == "POST" and
      (http.request.uri like~ "/apps/circles/event/*" or http.request.uri like~ "/apps/circles/incoming/*") and
      http.request.uri like~ "*keyId=*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_circles=if(match(uri,"^/apps/circles/(event|incoming)/"),1,0)
| eval has_keyid=if(match(uri,"[?&]keyId="),1,0)
| eval internal_target=if(match(uri,"(?i)keyId=https?(%3A|:)(%2F%2F|//)(127\.0\.0\.1|localhost|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|\[?::1\]?)"),1,0)
| where is_circles=1 AND has_keyid=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, internal_target
| sort - count

Wazuh OSSEC Rule

<group name="web,nextcloud,ssrf,">
  <rule id="771640" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <url>^/apps/circles/(event|incoming)/</url>
    <match>keyId=</match>
    <description>CVE-2026-77164: Nextcloud Circles federation endpoint invoked with keyId parameter (possible blind SSRF)</description>
    <group>cve_2026_77164,ssrf_attempt,</group>
  </rule>

  <rule id="771641" level="12">
    <if_sid>771640</if_sid>
    <regex>keyId=https?(%3A|:)(%2F%2F|//)(127\.0\.0\.1|localhost|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)</regex>
    <description>CVE-2026-77164: Nextcloud Circles keyId references a private/loopback address - active SSRF attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_77164,ssrf_attempt,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, fixed version, OSV package record, or workaround is identified in any tracked source. Affected version ranges are not enumerated in the supplied data. Do not assume any release fixes this issue.

1. Immediate mitigations (while unpatched):

• Restrict network exposure: Place Nextcloud federation endpoints behind an authenticated reverse proxy or WAF and block unauthenticated access to /apps/circles/event/ and /apps/circles/incoming/ from untrusted networks where Circles federation is not in active use.
• Disable Circles if not required: If federated circles are not needed, disable the Circles app to remove the vulnerable code path entirely.
• Egress filtering (highest-value control): Enforce egress policy on the Nextcloud host so outbound requests from the application cannot reach loopback, private (RFC 1918), link-local, or cloud metadata ranges. This directly defeats the described SSRF, since the flaw's impact depends on the server being able to reach internal addresses. Apply at the host firewall and, ideally, at an application-aware egress proxy.
• Network segmentation: Treat the Nextcloud host as low-trust; limit its ability to reach sensitive internal services.
• Metadata hardening: On cloud deployments, enforce IMDSv2 (AWS) or equivalent to reduce the value of metadata-endpoint SSRF.

2. Patch/upgrade steps:

• No patch exists as of the supplied data. Monitor the Nextcloud security advisories and the Circles app release feed for a fixed version. When a fix is published, validate it removes the pre-trust fetch and re-enables SSRF address validation for the keyId retrieval path, then upgrade promptly. Do not fabricate a target version — none is known here.

3. Long-term hardening:

• Enforce a deny-by-default SSRF policy for all server-side URL fetches, with no per-code-path exceptions that permit private/loopback addresses based on assumed trust.
• Require signature/trust verification to occur before any outbound key retrieval, or restrict key retrieval to allowlisted, pre-trusted peer locations.
• Add automated tests/regression checks that assert unauthenticated federation endpoints cannot cause requests to private ranges.
• Continuously monitor egress from application hosts for anomalous connections to internal addresses.

References

1. NVD — CVE-2026-77164: https://nvd.nist.gov/vuln/detail/CVE-2026-77164
2. CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
3. Nextcloud Security Advisories (monitor for Circles fix): https://nextcloud.com/security/
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA KEV Catalog (CVE-2026-77164 not listed — no confirmed in-the-wild exploitation as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. POC_STATUS is None, no Nuclei template, no exploit code, and no CISA KEV entry. EPSS is not yet scored by FIRST.org; no EPSS value is asserted. Detection above is behavioral (federation endpoint abuse and private-address targeting), not signature-specific.