https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 16:04:51 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-55640 <p>Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud_mcp_server/vector/webhook_receiver.py has no authentication by default because WEBHOOK_SECRET defaults to None and startup validation does not require it. When WEBHOOK_SECRET is unset, handle_nextcloud_webhook() accepts unauthenticated requests. The payload[&#34;user&#34;][&#34;uid&#34;] field parsed in nextcloud_mcp_server/vector/webhook_parser.py is attacker-controlled and is used without an authenticated-session cross-check for Qdrant operations, allowing a network attacker to delete or trigger re-indexing of vector embeddings for any user and to destroy the semantic search index by sending forged deletion events. This issue is fixed in version 0.117.2.</p> <p>Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud_mcp_server/vector/webhook_receiver.py has no authentication by default because WEBHOOK_SECRET defaults to None and startup validation does not require it. When WEBHOOK_SECRET is unset, handle_nextcloud_webhook() accepts unauthenticated requests. The payload[&#34;user&#34;][&#34;uid&#34;] field parsed in nextcloud_mcp_server/vector/webhook_parser.py is attacker-controlled and is used without an authenticated-session cross-check for Qdrant operations, allowing a network attacker to delete or trigger re-indexing of vector embeddings for any user and to destroy the semantic search index by sending forged deletion events. This issue is fixed in version 0.117.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-55640 https://vulnerability.circl.lu/vuln/ghsa-8vh3-g2qg-2h2c <p><strong>Affected:</strong> PyPI: nextcloud-mcp-server</p> <p>## Summary The `POST /webhooks/nextcloud` endpoint has no authentication by default: `WEBHOOK_SECRET` defaults to `None` and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The `user_id` is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.</p> <p>## Details **Vulnerable file:** `nextcloud_mcp_server/vector/webhook_receiver.py`, function `handle_nextcloud_webhook()`, **lines 55-67**</p> <p>**Root cause 1**: Auth check is guarded by `if secret`: - skipped entirely when `WEBHOOK_SECRET` is unset.</p> <p>**Root cause 2**: `webhook_secret: str | None = None` in config - no startup validator enforces it, even when vector sync is enabled.</p> <p>**Trusted field**: `payload[&#34;user&#34;][&#34;uid&#34;]` in `webhook_parser.py` is used as-is for all Qdrant operations - no cross-check against an authenticated session.</p> <p>`webhook_receiver.py`, **lines 55-67**: ```python secret = get_settings().webhook_secret # None by default if secret: # skipped entirely when unset ... validate Bearer header ... else: _warn_missing_secret_once() # just logs, still processes ``` `webhook_parser.py`, **line 57**: ```python user_id = payload[&#34;user&#34;][&#34;uid&#34;] # attacker-controlled ``` ## PoC **No credentials required**. Works on any deployment where `WEBHOOK_SECRET` is not explicitly set (the default). ```json POST /webhooks/nextcloud Content-…</p> <p><strong>Affected:</strong> PyPI: nextcloud-mcp-server</p> <p>## Summary The `POST /webhooks/nextcloud` endpoint has no authentication by default: `WEBHOOK_SECRET` defaults to `None` and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The `user_id` is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.</p> <p>## Details **Vulnerable file:** `nextcloud_mcp_server/vector/webhook_receiver.py`, function `handle_nextcloud_webhook()`, **lines 55-67**</p> <p>**Root cause 1**: Auth check is guarded by `if secret`: - skipped entirely when `WEBHOOK_SECRET` is unset.</p> <p>**Root cause 2**: `webhook_secret: str | None = None` in config - no startup validator enforces it, even when vector sync is enabled.</p> <p>**Trusted field**: `payload[&#34;user&#34;][&#34;uid&#34;]` in `webhook_parser.py` is used as-is for all Qdrant operations - no cross-check against an authenticated session.</p> <p>`webhook_receiver.py`, **lines 55-67**: ```python secret = get_settings().webhook_secret # None by default if secret: # skipped entirely when unset ... validate Bearer header ... else: _warn_missing_secret_once() # just logs, still processes ``` `webhook_parser.py`, **line 57**: ```python user_id = payload[&#34;user&#34;][&#34;uid&#34;] # attacker-controlled ``` ## PoC **No credentials required**. Works on any deployment where `WEBHOOK_SECRET` is not explicitly set (the default). ```json POST /webhooks/nextcloud Content-…</p> https://vulnerability.circl.lu/vuln/ghsa-8vh3-g2qg-2h2c https://vulnerability.circl.lu/vuln/pysec-2026-3866 <p><strong>Affected:</strong> PyPI: nextcloud-mcp-server</p> <p>## Summary The `POST /webhooks/nextcloud` endpoint has no authentication by default: `WEBHOOK_SECRET` defaults to `None` and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The `user_id` is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.</p> <p>## Details **Vulnerable file:** `nextcloud_mcp_server/vector/webhook_receiver.py`, function `handle_nextcloud_webhook()`, **lines 55-67**</p> <p>**Root cause 1**: Auth check is guarded by `if secret`: - skipped entirely when `WEBHOOK_SECRET` is unset.</p> <p>**Root cause 2**: `webhook_secret: str | None = None` in config - no startup validator enforces it, even when vector sync is enabled.</p> <p>**Trusted field**: `payload[&#34;user&#34;][&#34;uid&#34;]` in `webhook_parser.py` is used as-is for all Qdrant operations - no cross-check against an authenticated session.</p> <p>`webhook_receiver.py`, **lines 55-67**: ```python secret = get_settings().webhook_secret # None by default if secret: # skipped entirely when unset ... validate Bearer header ... else: _warn_missing_secret_once() # just logs, still processes ``` `webhook_parser.py`, **line 57**: ```python user_id = payload[&#34;user&#34;][&#34;uid&#34;] # attacker-controlled ``` ## PoC **No credentials required**. Works on any deployment where `WEBHOOK_SECRET` is not explicitly set (the default). ```json POST /webhooks/nextcloud Content-…</p> <p><strong>Affected:</strong> PyPI: nextcloud-mcp-server</p> <p>## Summary The `POST /webhooks/nextcloud` endpoint has no authentication by default: `WEBHOOK_SECRET` defaults to `None` and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The `user_id` is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.</p> <p>## Details **Vulnerable file:** `nextcloud_mcp_server/vector/webhook_receiver.py`, function `handle_nextcloud_webhook()`, **lines 55-67**</p> <p>**Root cause 1**: Auth check is guarded by `if secret`: - skipped entirely when `WEBHOOK_SECRET` is unset.</p> <p>**Root cause 2**: `webhook_secret: str | None = None` in config - no startup validator enforces it, even when vector sync is enabled.</p> <p>**Trusted field**: `payload[&#34;user&#34;][&#34;uid&#34;]` in `webhook_parser.py` is used as-is for all Qdrant operations - no cross-check against an authenticated session.</p> <p>`webhook_receiver.py`, **lines 55-67**: ```python secret = get_settings().webhook_secret # None by default if secret: # skipped entirely when unset ... validate Bearer header ... else: _warn_missing_secret_once() # just logs, still processes ``` `webhook_parser.py`, **line 57**: ```python user_id = payload[&#34;user&#34;][&#34;uid&#34;] # attacker-controlled ``` ## PoC **No credentials required**. Works on any deployment where `WEBHOOK_SECRET` is not explicitly set (the default). ```json POST /webhooks/nextcloud Content-…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3866