CVE-2026-28474: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28474 is an incorrect authorization vulnerability in OpenClaw's optional Nextcloud Talk plugin (@openclaw/nextcloud-talk) that allows attackers to bypass DM and room allowlists by spoofing their display name. Affected versions are all releases up to and including 2026.2.2 (fixed in 2026.2.6). The vulnerability was introduced on 2026-01-20, reported by MegaManSec of AISLE Research Team, and the advisory was published on 2026-03-05. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Feedly).

The root cause is CWE-863 (Incorrect Authorization): the plugin's resolveNextcloudTalkAllowlistMatch function accepted equality matching on both the stable actor.id (user ID) and the mutable actor.name (display name) field from Nextcloud Talk webhook payloads (GitHub Advisory). Because actor.name is user-controlled and can be freely changed in Nextcloud, an attacker can set their display name to match any allowlisted user ID string, causing the allowlist check to return allowed: true via the matchSource: "name" path (GitHub Commit). The fix removes senderName from all calls to resolveNextcloudTalkAllowlistMatch and resolveNextcloudTalkGroupAllow, ensuring only the immutable actor.id is used for allowlist validation. This vulnerability only affects deployments that have installed and configured the optional @openclaw/nextcloud-talk npm package; core OpenClaw is not impacted (GitHub Advisory).

Successful exploitation allows an unauthenticated or low-privileged network attacker to gain unauthorized read and write access to restricted direct message conversations and room-based conversations that are protected by allowlists (GitHub Advisory, Feedly). This results in high confidentiality impact (exposure of private messages), high integrity impact (ability to send messages as an impersonated identity into restricted channels), and potentially high availability impact per the CVSS scoring. Organizations using OpenClaw for sensitive internal communications via Nextcloud Talk are at risk of data leakage and unauthorized message injection into protected conversations.

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.039%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and no special privileges — only the ability to change a Nextcloud display name and send a webhook payload — making it trivially exploitable by any Nextcloud user on an affected instance.

1. Identify target: Determine that the target OpenClaw deployment has the @openclaw/nextcloud-talk npm package installed and configured with a DM or room allowlist (versions <= 2026.2.2).
2. Enumerate allowlisted user IDs: Identify the Nextcloud user IDs that are present in the OpenClaw allowlist (e.g., via social engineering, Nextcloud user directory, or prior access).
3. Change display name: Log into Nextcloud as any user (including a low-privileged account) and change the account's display name (actor.name) to exactly match an allowlisted user ID string.
4. Send a message to the restricted conversation: Send a direct message or room message via Nextcloud Talk to the OpenClaw bot or webhook endpoint.
5. Bypass allowlist: The OpenClaw plugin receives the webhook payload, evaluates the allowlist using the attacker-controlled actor.name field, matches it against the allowlist, and grants access — allowing the attacker to read responses and inject messages into the restricted conversation (GitHub Advisory, GitHub Commit).

• Logs: OpenClaw application logs showing allowlist matches with matchSource: "name" rather than matchSource: "id" for inbound Nextcloud Talk messages; unexpected access to restricted DM or room conversations from unfamiliar Nextcloud user IDs.
• Nextcloud Audit Logs: Display name change events (actor.name updates) for accounts that subsequently send messages to OpenClaw-integrated rooms or DMs, particularly where the new display name matches a known allowlisted user ID.
• Application Behavior: Messages appearing in restricted OpenClaw conversations from senders whose actor.id does not match any allowlisted entry but whose actor.name does match an allowlisted user ID.

Upgrade the @openclaw/nextcloud-talk npm package to version 2026.2.6 or later, which enforces allowlist matching exclusively on the immutable actor.id field (GitHub Advisory, GitHub Commit). As a temporary workaround prior to patching, administrators can restrict Nextcloud display name changes via Nextcloud admin settings to prevent users from setting arbitrary display names. After upgrading, review access logs to identify any suspicious access to restricted conversations that may have occurred using allowlisted display names (Feedly).

The Belgium Centre for Cybersecurity (CCB) issued a warning advisory regarding critical vulnerabilities in OpenClaw's Nextcloud Talk plugin, recommending immediate patching (CCB Advisory). The vulnerability received coverage from security aggregators and community platforms including Mastodon and Bluesky, with the OpenClaw hosting community blog also publishing a post covering the 2026 CVEs affecting the Nextcloud Talk plugin (ClawHosters Blog). Community reaction has been moderate, with the primary focus on the straightforward nature of the bypass and the ease of remediation via upgrade.