AI Threat AlertCVE-2026-28474: OpenClaw Nextcloud Talk: allowlist bypass via display name
CRITICALCISA: TRACK*OpenClaw's Nextcloud Talk plugin before 2026.2.6 validates allowlists by comparing the mutable display name (actor.name) instead of the immutable user ID, so any Nextcloud user can rename themselves to match an allowlisted identity and reach restricted DMs and rooms. The CVSS 9.8 score reflects network exploitation with no privileges or user interaction, and the bypass lets an attacker interact with an AI agent that may hold tools and credentials. Real-world exploitation risk is currently moderate: EPSS is 0.00878 (top 42%), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and SSVC is TRACK*. Only 3 downstream dependents are tracked, so blast radius is limited, but the same package has 579 other CVEs, which signals weak security hygiene. Upgrade to 2026.2.6 or later (fix in commit 6b4b604 per GHSA-r5h9-vjqc-hq3r), and audit Nextcloud Talk logs for display-name changes that coincide with agent access.
What is the risk?
Rated critical on CVSS (9.8) because the flaw is a network-reachable authorization bypass (CWE-863) needing no privileges or interaction. Exploitation is trivial, since changing a display name is a standard user feature. Live exploitation likelihood is lower than the score implies: EPSS 0.00878 (top 42%), no KEV listing, no public exploit or scanner template, and SSVC TRACK*. Actual risk depends on what the agent can do once reached. Deployments that connect OpenClaw to tools, files, or internal systems carry high impact, and those on open Nextcloud instances where anyone can register carry the highest exposure.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
6 stepsUpgrade OpenClaw to 2026.2.6 or later, which matches allowlist entries on stable user IDs rather than display names.
Until patched, disable the Nextcloud Talk plugin or restrict it to rooms where all members are vetted.
Prevent users from editing their own display names in Nextcloud (disable the profile display-name edit setting) and restrict self-registration.
Review allowlists to confirm they contain immutable user IDs, not display names.
Audit Nextcloud Talk and OpenClaw logs for display-name changes and for agent actions from unexpected actors.
Apply least privilege to the agent's tools and credentials to limit damage from a bypass.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-28474?
OpenClaw's Nextcloud Talk plugin before 2026.2.6 validates allowlists by comparing the mutable display name (actor.name) instead of the immutable user ID, so any Nextcloud user can rename themselves to match an allowlisted identity and reach restricted DMs and rooms. The CVSS 9.8 score reflects network exploitation with no privileges or user interaction, and the bypass lets an attacker interact with an AI agent that may hold tools and credentials. Real-world exploitation risk is currently moderate: EPSS is 0.00878 (top 42%), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and SSVC is TRACK*. Only 3 downstream dependents are tracked, so blast radius is limited, but the same package has 579 other CVEs, which signals weak security hygiene. Upgrade to 2026.2.6 or later (fix in commit 6b4b604 per GHSA-r5h9-vjqc-hq3r), and audit Nextcloud Talk logs for display-name changes that coincide with agent access.
Is CVE-2026-28474 actively exploited?
No confirmed active exploitation of CVE-2026-28474 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-28474?
1. Upgrade OpenClaw to 2026.2.6 or later, which matches allowlist entries on stable user IDs rather than display names. 2. Until patched, disable the Nextcloud Talk plugin or restrict it to rooms where all members are vetted. 3. Prevent users from editing their own display names in Nextcloud (disable the profile display-name edit setting) and restrict self-registration. 4. Review allowlists to confirm they contain immutable user IDs, not display names. 5. Audit Nextcloud Talk and OpenClaw logs for display-name changes and for agent actions from unexpected actors. 6. Apply least privilege to the agent's tools and credentials to limit damage from a bypass.
What systems are affected by CVE-2026-28474?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chat-integrated AI assistants, agent plugin/channel integrations.
What is the CVSS score for CVE-2026-28474?
CVE-2026-28474 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.55%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0073ImpersonationCompliance Controls Affected
What are the technical details?
Original Advisory
OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations.
Exploitation Scenario
An attacker with any account on the target Nextcloud instance, via open registration or a low-privilege guest, finds the user ID of an executive or administrator who is on the OpenClaw allowlist. They set their own display name to that value, then send a DM or join the restricted room. The plugin compares actor.name with the allowlist, accepts the message, and passes it to the AI agent. The attacker then instructs the agent to retrieve internal documents, call connected tools, or leak data from the conversation context, with no alert because the request appears to come from a trusted user.
Weaknesses (CWE)
CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-221729.9OpenClaw: WebSocket scope self-elevation grants admin
Same package: openclawCVE-2026-335799.9OpenClaw: scope bypass escalates low-priv to admin
Same package: openclawCVE-2026-329229.9OpenClaw: privilege escalation to RCE via token scope bypass
Same package: openclawCVE-2026-320389.8OpenClaw: sandbox bypass enables container lateral movement
Same package: openclawCVE-2026-538389.8OpenClaw: approval scope bypass via reconnection state
Same package: openclaw