Unauthenticated Webhook in nextcloud-mcp-server Allows Attackers to Wipe Users' Vector Search Indexes

A newly published GitHub Security Advisory (GHSA-8vh3-g2qg-2h2c, CVE-2026-55640, CVSS 9.1) discloses a missing-authentication vulnerability in nextcloud-mcp-server, a Python package on PyPI.

What was reported

According to the advisory, the POST /webhooks/nextcloud endpoint has no authentication by default. The WEBHOOK_SECRET setting defaults to None, and no startup validation enforces that it be set — even when vector sync is enabled. When the secret is unset, the receiver logs a one-time warning but still processes the request. Compounding this, the handler trusts payload["user"]["uid"] directly from the attacker-supplied JSON body with no cross-check against an authenticated session, and uses it to drive deletions in the Qdrant vector store. A public proof-of-concept is included in the advisory showing that a single unauthenticated POST can cause Qdrant to delete a victim user's document embeddings, and that this can be looped across document IDs for mass deletion of the semantic search index.

Why it matters

This affects any deployment of nextcloud-mcp-server that has not explicitly set WEBHOOK_SECRET — the advisory states this is the default configuration, so exposure is plausibly widespread among adopters who followed default setup. Any network-adjacent, unauthenticated party with reach to the service (the advisory cites port 8000) can destroy or corrupt another user's vector embeddings, degrading or destroying Nextcloud semantic search functionality and requiring a full re-index to recover. There is no data-exfiltration claim in the advisory — the impact described is integrity/availability of the vector index, not disclosure.

What defenders should do now

• Check whether WEBHOOK_SECRET is explicitly set in your nextcloud-mcp-server deployment; if unset, treat the webhook endpoint as unauthenticated and exposed.
• Restrict network reachability to the webhook port (e.g. 8000) to trusted hosts only until patched or reconfigured, pending vendor guidance.
• Hunt for anomalous POST /webhooks/nextcloud traffic in access logs, especially requests without a valid Bearer authorization header or with user.uid values that don't correspond to legitimate session activity.
• Watch for unexpected Qdrant deletion/re-index events correlating to webhook activity, and for unexplained gaps or resets in semantic search results.
• Track the upstream fix — the advisory recommends enforcing WEBHOOK_SECRET at startup when vector sync is enabled and rejecting/authenticating webhook requests with a constant-time comparison — and apply it once released.

Developing intel

This is a same-day advisory and details may evolve as the maintainers respond and a patched release is issued. For the full technical write-up, root-cause code references, and proof-of-concept, see the original GitHub Security Advisory: GHSA-8vh3-g2qg-2h2c.