nextcloud-mcp-server

Nextcloud MCP Server

View on Pypi

View on Github

Activity

Latest release: 4h ago
Total releases: 336
Cadence: ~daily
Last 12 months: 335

Reach

Stars: 395

Details

License: unknown
First release: Oct 20, 2025

Releases

Version	Released
`0.203.0` minor	Oct 29, 2026
`0.202.2` patch	Oct 28, 2026
`0.202.1` patch	Oct 26, 2026
`0.202.0` minor	Oct 26, 2026
`0.201.3` patch	Oct 26, 2026
`0.201.2` patch	Oct 24, 2026
`0.201.1` patch	Oct 24, 2026
`0.201.0` minor	Oct 24, 2026
`0.200.5` patch	Oct 21, 2026
`0.200.4` patch	Oct 21, 2026
`0.200.3` patch	Oct 21, 2026
`0.200.2` patch	Oct 20, 2026
`0.200.1` patch	Oct 20, 2026
`0.200.0` minor	Oct 20, 2026
`0.199.4` patch	Oct 12, 2026
`0.199.3` patch	Oct 09, 2026
`0.199.2` patch	Oct 09, 2026
`0.199.1` patch	Oct 08, 2026
`0.199.0` minor	Oct 08, 2026
`0.198.5` patch	Oct 06, 2026
`0.198.4` patch	Oct 06, 2026
`0.198.3` patch	Oct 01, 2026
`0.198.2` patch	Oct 01, 2026
`0.198.1` patch	Sep 30, 2026
`0.198.0` minor	Sep 28, 2026
`0.197.1` patch	Sep 27, 2026
`0.197.0` minor	Sep 27, 2026
`0.196.0` minor	Sep 27, 2026
`0.195.5` patch	Sep 27, 2026
`0.195.4` patch	Sep 25, 2026
`0.195.3` patch	Sep 24, 2026
`0.195.2` patch	Sep 24, 2026
`0.195.1` patch	Sep 23, 2026
`0.195.0` minor	Sep 19, 2026
`0.194.0` minor	Sep 19, 2026
`0.193.1` patch	Sep 18, 2026
`0.193.0` minor	Sep 18, 2026
`0.192.0` minor	Sep 18, 2026
`0.191.0` minor	Sep 17, 2026
`0.190.1` patch	Sep 17, 2026
`0.190.0` minor	Sep 17, 2026
`0.189.0` minor	Sep 16, 2026
`0.188.1` patch	Sep 15, 2026
`0.188.0` minor	Sep 15, 2026
`0.187.1` patch	Sep 12, 2026
`0.187.0` minor	Sep 12, 2026
`0.186.0` minor	Sep 11, 2026
`0.185.5` patch	Sep 11, 2026
`0.185.4` patch	Sep 11, 2026
`0.185.3` patch	Sep 09, 2026

1–50 of 336

Repository

cbcoutinho/nextcloud-mcp-server

Forks: 94
Open issues: 45
Language: Python

mcp-server
nextcloud
nextcloud-notes
model-context-protocol
nextcloud-deck
rag

Dependencies (50)

Depends on

0.203.0

Used by

Supply-chain exposure

1 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-55640 PYSEC-2026-3866 GHSA-8vh3-g2qg-2h2c Sep 10, 2026

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

9.1 / 10
Critical
Network Low None None Unchanged None High High

Summary

The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOK_SECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The user_id is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.

Details

Vulnerable file: nextcloud_mcp_server/vector/webhook_receiver.py, function handle_nextcloud_webhook(), lines 55-67

Root cause 1: Auth check is guarded by if secret: - skipped entirely when WEBHOOK_SECRET is unset.

Root cause 2: webhook_secret: str | None = None in config - no startup validator enforces it, even when vector sync is enabled.

Trusted field: payload["user"]["uid"] in webhook_parser.py is used as-is for all Qdrant operations - no cross-check against an authenticated session.

webhook_receiver.py, lines 55-67:

secret = get_settings().webhook_secret # None by default if secret: # skipped entirely when unset ... validate Bearer header ... else: _warn_missing_secret_once() # just logs, still processes

webhook_parser.py, line 57:

user_id = payload["user"]["uid"] # attacker-controlled

PoC

No credentials required. Works on any deployment where WEBHOOK_SECRET is not explicitly set (the default).

POST /webhooks/nextcloud Content-Type: application/json { "event": { "class": "OCP\\Files\\Events\\Node\\BeforeNodeDeletedEvent", "node": { "path": "/victim/files/Notes/any.md", "id": 12345 } }, "user": { "uid": "victim" }, "time": 0 }

Result: Qdrant deletes all vector embeddings for victim doc 12345 with no authentication. Attacker can loop over doc IDs for mass deletion. All user targets accepted.

Impact

Anyone on the network with access to port 8000 - no credentials needed.

Attacker can delete or trigger re-index of any user's vector embeddings in Qdrant by spoofing user.uid in the payload.

Mass-sending delete events for all doc IDs destroys the entire semantic search index for all users, requiring a full re-scan to recover.

Recommend Fix

Enforce WEBHOOK_SECRET at startup ( file config_validators.py )

if vector_sync_enabled and not settings.webhook_secret: raise ConfigurationError( "WEBHOOK_SECRET must be set when vector sync is enabled" )

Reject requests when secret is unset ( file webhook_receiver.py )

secret = get_settings().webhook_secret if not secret: return JSONResponse({"status": "unavailable"}, status_code=503) provided = request.headers.get("authorization", "").encode() if not hmac.compare_digest(provided, f"Bearer {secret}".encode()): return JSONResponse({"status": "unauthorized"}, status_code=401)

Affected versions

0.100.00.101.00.101.10.101.20.101.30.101.40.102.00.103.00.104.00.104.10.105.00.106.0

+ 106 more Show less

0.107.00.108.00.108.10.108.20.108.30.109.00.109.10.110.00.110.10.110.20.111.00.112.00.113.00.113.10.114.00.115.00.115.10.116.00.117.00.117.10.17.10.65.30.65.40.66.00.66.10.66.20.67.00.68.00.68.10.68.20.68.30.68.40.69.00.70.00.70.10.70.20.70.30.70.40.71.00.72.00.72.10.72.20.72.30.72.40.72.50.72.60.72.70.73.00.73.10.73.20.74.00.75.00.75.10.75.20.76.00.77.00.77.10.78.00.79.00.79.10.79.20.79.30.80.00.81.00.82.00.83.00.83.10.83.20.83.30.83.40.84.00.84.10.84.20.85.00.85.10.86.00.86.10.86.20.86.30.86.40.87.00.87.10.87.20.88.00.88.10.88.20.88.30.89.00.90.00.90.10.90.20.91.00.91.10.91.20.91.30.92.00.92.10.93.00.94.00.94.10.95.00.96.00.97.00.98.00.98.10.99.0

Fixed in

0.117.2

References

https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/GHSA-8vh3-g2qg-2h2c
https://github.com/cbcoutinho/nextcloud-mcp-server/commit/4fc2b10945108cf1008ec9698291de6706ffcb73
https://github.com/cbcoutinho/nextcloud-mcp-server
https://github.com/cbcoutinho/nextcloud-mcp-server/tree/v0.117.2
https://pypi.org/project/nextcloud-mcp-server
https://github.com/advisories/GHSA-8vh3-g2qg-2h2c

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 139
patch 196

336 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More