PT-2026-23549 · Openclaw+1 · @Openclaw/Nextcloud-Talk+1

Megamansec · Published 2026-01-20 · Updated 2026-05-11 · CVE-2026-28474

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenClaw Nextcloud Talk plugin versions prior to 2026.2.6

Description The Nextcloud Talk plugin allows attackers to bypass direct message (DM) and room allowlists. The plugin incorrectly uses the mutable actor.name field for allowlist validation. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations. The vulnerable field is actor.name, which is part of the webhook payload.

Recommendations Upgrade @openclaw/nextcloud-talk to version 2026.2.6 or later.

Fix

Authentication Bypass by Spoofing

Incorrect Authorization

Weakness Enumeration

CWE-290

CWE-863

Related Identifiers

BDU:2026-06171

CVE-2026-28474

GHSA-R5H9-VJQC-HQ3R

Affected Products

@Openclaw/Nextcloud-Talk

Nextcloud Talk

References · 18

• https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d · Patch
• https://osv.dev/vulnerability/CVE-2026-28474 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06171 · Security Note
• https://osv.dev/vulnerability/GHSA-r5h9-vjqc-hq3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28474 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/660f87278c9f292061e097441e0b10c20d62b31b · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.3 · Note
• https://t.me/CVEtracker/46493 · Telegram Post
• https://vulncheck.com/advisories/openclaw-nextcloud-talk-allowlist-bypass-via-actorname-display-name-spoofing · Note
• https://twitter.com/CveFindCom/status/2029689254549283009 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029906835885674585 · Twitter Post
• https://twitter.com/CVEnew/status/2030385173586497863 · Twitter Post
• https://twitter.com/lyrie_ai/status/2053740826325361130 · Twitter Post