CVE-2026-28474 json
OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing
published 8mo ago modified last mo. also GHSA-r5h9-vjqc-hq3r , EUVD-2026-9920
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations.
Patch / fix
- npm @openclaw/nextcloud-talk 2026.2.6
- OpenClaw nextcloud-talk 2026.2.6
Is CVE-2026-28474 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 8mo ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @openclaw/nextcloud-talk | <2026.2.6 |
2026.2.6 |
Affected products
- OpenClaw nextcloud-talk
Classification
References
-
github.com
/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d
patch, web
-
github.com
/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r
vendor-advisory, web, patch
-
github.com
/openclaw/openclaw/commit/660f87278c9f292061e097441e0b10c20d62b31b
web
-
vulncheck.com
/advisories/openclaw-nextcloud-talk-allowlist-bypass-via-actorname-display-name-spoofing
third-party-advisory, broken-link
-
github.com
/openclaw/openclaw
package
-
github.com
/openclaw/openclaw/releases/tag/v2026.2.3
web
Sources
- CVE List CVE-2026-28474
- GitHub Advisory GHSA-r5h9-vjqc-hq3r
- NVD CVE-2026-28474
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.