External risk intelligence

Nextcloud MCP Server Unauthenticated Webhook Deletes Vector Embeddings

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-55640

The vulnerability exists in a webhook receiver endpoint designed to receive external data from a Nextcloud instance. Webhook receivers are commonly exposed to the internet or at least to the network perimeter to receive event notifications, making the endpoint a likely target for external network-based interaction.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Nextcloud MCP Server has a critical vulnerability where an unauthenticated network attacker can delete or re-index vector embeddings for any user, potentially destroying the semantic search index. This impacts the integrity and availability of AI assistant integrations.

Unauthenticated attackers can corrupt AI search data.
This impacts AI assistant integration integrity.
Confirm relevance and assess exposure for AI services.

Attack Path

How an attacker could exploit the issue

A network attacker can exploit this vulnerability by sending a forged deletion request to the Nextcloud MCP Server's webhook receiver. Because the webhook endpoint lacks authentication by default, the attacker can specify any user's unique identifier to delete their vector embeddings or trigger a re-indexing process, ultimately destroying the semantic search index.

No authentication required to access endpoint.
Triggered by sending a forged deletion event.
Allows arbitrary data deletion and index destruction.

Live Threat

Current exploitation, exposure, and threat context

A network attacker could delete or re-index vector embeddings for any user, and destroy the semantic search index, by sending forged deletion events to an unauthenticated webhook endpoint. This is possible when the webhook secret is not configured, allowing manipulation of AI assistant data.

Vector embeddings and semantic search index.
Unauthenticated webhook endpoint accepts forged events.
Loss of AI assistant data and search functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Nextcloud MCP Server's webhook receiver is likely managed by the platform or infrastructure team, with input from security and application owners. The initial step involves identifying all instances of this server, confirming their network exposure, and assessing business criticality to prioritize remediation efforts and engage the appropriate system owner.

Platform/Infrastructure teams own the issue.
Verify webhook endpoint accessibility and configuration.
Plan remediation based on identified exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Nextcloud MCP Server?

It is a specialized bridge component that connects AI assistants to a Nextcloud instance. It functions as a Model Context Protocol (MCP) server, allowing AI tools to interact with Nextcloud data. Developers and system administrators use it to enable semantic search and other AI-driven features by maintaining vector embeddings—mathematical representations of data—within a Qdrant database, ensuring AI assistants have access to relevant, up-to-date information from the platform.

What does CWE-306 mean for CVE-2026-55640?

CWE-306 refers to Missing Authentication for Critical Function. In this case, the vulnerability exists because the software's webhook receiver does not verify the identity of incoming requests by default. Because the system fails to enforce a required security secret during startup, it essentially leaves a digital door unlocked. An attacker can send requests to this endpoint without providing proof of authorization, allowing them to perform actions that should be strictly protected.

How is this vulnerability triggered?

An attacker triggers the issue by sending a forged request to the webhook endpoint. The vulnerability is specifically active when the WEBHOOK_SECRET configuration is left at its default 'None' value. Importantly, simply having the software installed is not enough; the bug is only exploitable if the system has not been configured with a secret, as the code lacks a requirement to force this setup during initial deployment.

How do I know if my instance is at risk?

Halo Surface Signal indicates this issue is likely relevant if your Nextcloud MCP Server is reachable from an external network or sits at your organization's perimeter. Because the affected webhook receiver is designed to ingest data from external sources, it is frequently placed in network zones that allow broad access. If your instance is exposed to the internet, it is a primary candidate for unauthorized interaction via this unauthenticated endpoint.

What should I do to secure my deployment?

The immediate priority is to update your Nextcloud MCP Server to version 0.117.2 or later, which addresses the authentication flaw. Before updating, work with your infrastructure or platform team to audit your current configuration. Confirm whether your webhook secret is currently unset and evaluate the network visibility of your server. Once the update is applied, ensure that a strong, unique WEBHOOK_SECRET is explicitly configured to prevent unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.