Frontier models can vanish overnight. Control is the new frontier in security AI.See why→

CVE-2026-28474

Discovered by AISLEPUBLISHEDCWE-863

Description

OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations.

CVSS Base Scores

CVSS v4.09.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1
9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersionStatus
OpenClawnextcloud-talk0affected

Credits

  • @MegaManSec (https://joshua.hu) of AISLE Research Team(reporter)

References