nextcloud-mcp-server

Nextcloud MCP Server

View on Pypi

View on Github

Activity

Latest release: 1d ago
Total releases: 292
Cadence: ~daily
Last 12 months: 292

Reach

Stars: 353

Details

License: unknown
First release: Oct 20, 2025

Releases

Version	Released
`0.187.1` patch	Sep 12, 2026
`0.187.0` minor	Sep 12, 2026
`0.186.0` minor	Sep 11, 2026
`0.185.5` patch	Sep 11, 2026
`0.185.4` patch	Sep 11, 2026
`0.185.3` patch	Sep 09, 2026
`0.185.2` patch	Sep 09, 2026
`0.185.1` patch	Sep 08, 2026
`0.185.0` minor	Sep 05, 2026
`0.184.5` patch	Sep 04, 2026
`0.184.4` patch	Sep 04, 2026
`0.184.3` patch	Sep 03, 2026
`0.184.2` patch	Sep 01, 2026
`0.184.1` patch	Aug 30, 2026
`0.184.0` minor	Aug 30, 2026
`0.183.1` patch	Aug 28, 2026
`0.183.0` minor	Aug 28, 2026
`0.182.0` minor	Aug 26, 2026
`0.181.1` patch	Aug 26, 2026
`0.181.0` minor	Aug 22, 2026
`0.180.0` minor	Aug 21, 2026
`0.179.0` minor	Aug 19, 2026
`0.178.1` patch	Aug 18, 2026
`0.178.0` minor	Aug 18, 2026
`0.177.2` patch	Aug 18, 2026
`0.177.1` patch	Aug 18, 2026
`0.177.0` minor	Aug 18, 2026
`0.176.5` patch	Aug 17, 2026
`0.176.4` patch	Aug 17, 2026
`0.176.3` patch	Aug 17, 2026
`0.176.2` patch	Aug 17, 2026
`0.176.1` patch	Aug 17, 2026
`0.176.0` minor	Aug 17, 2026
`0.175.0` minor	Aug 15, 2026
`0.174.1` patch	Aug 15, 2026
`0.174.0` minor	Aug 15, 2026
`0.173.1` patch	Aug 14, 2026
`0.173.0` minor	Aug 13, 2026
`0.172.0` minor	Aug 12, 2026
`0.171.0` minor	Aug 12, 2026
`0.170.2` patch	Aug 12, 2026
`0.170.1` patch	Aug 12, 2026
`0.170.0` minor	Aug 12, 2026
`0.169.2` patch	Aug 11, 2026
`0.169.1` patch	Aug 11, 2026
`0.169.0` minor	Aug 09, 2026
`0.168.0` minor	Aug 09, 2026
`0.167.0` minor	Aug 09, 2026
`0.166.1` patch	Aug 08, 2026
`0.166.0` minor	Aug 05, 2026

1–50 of 292

Repository

cbcoutinho/nextcloud-mcp-server

Forks: 71
Open issues: 36
Language: Python

mcp-server
nextcloud
nextcloud-notes
model-context-protocol
nextcloud-deck
rag

Dependencies (45)

Depends on

0.187.1

Supply-chain exposure

Known CVEs (1)

CVE-2026-55640 PYSEC-2026-3866 GHSA-8vh3-g2qg-2h2c Sep 10, 2026

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

9.1 / 10
Critical
Network Low None None Unchanged None High High

Summary

The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOK_SECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The user_id is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.

Details

Vulnerable file: nextcloud_mcp_server/vector/webhook_receiver.py, function handle_nextcloud_webhook(), lines 55-67

Root cause 1: Auth check is guarded by if secret: - skipped entirely when WEBHOOK_SECRET is unset.

Root cause 2: webhook_secret: str | None = None in config - no startup validator enforces it, even when vector sync is enabled.

Trusted field: payload["user"]["uid"] in webhook_parser.py is used as-is for all Qdrant operations - no cross-check against an authenticated session.

webhook_receiver.py, lines 55-67:

secret = get_settings().webhook_secret # None by default if secret: # skipped entirely when unset ... validate Bearer header ... else: _warn_missing_secret_once() # just logs, still processes

webhook_parser.py, line 57:

user_id = payload["user"]["uid"] # attacker-controlled

PoC

No credentials required. Works on any deployment where WEBHOOK_SECRET is not explicitly set (the default).

POST /webhooks/nextcloud Content-Type: application/json { "event": { "class": "OCP\\Files\\Events\\Node\\BeforeNodeDeletedEvent", "node": { "path": "/victim/files/Notes/any.md", "id": 12345 } }, "user": { "uid": "victim" }, "time": 0 }

Result: Qdrant deletes all vector embeddings for victim doc 12345 with no authentication. Attacker can loop over doc IDs for mass deletion. All user targets accepted.

Impact

Anyone on the network with access to port 8000 - no credentials needed.

Attacker can delete or trigger re-index of any user's vector embeddings in Qdrant by spoofing user.uid in the payload.

Mass-sending delete events for all doc IDs destroys the entire semantic search index for all users, requiring a full re-scan to recover.

Recommend Fix

Enforce WEBHOOK_SECRET at startup ( file config_validators.py )

if vector_sync_enabled and not settings.webhook_secret: raise ConfigurationError( "WEBHOOK_SECRET must be set when vector sync is enabled" )

Reject requests when secret is unset ( file webhook_receiver.py )

secret = get_settings().webhook_secret if not secret: return JSONResponse({"status": "unavailable"}, status_code=503) provided = request.headers.get("authorization", "").encode() if not hmac.compare_digest(provided, f"Bearer {secret}".encode()): return JSONResponse({"status": "unauthorized"}, status_code=401)

Affected versions

0.100.00.101.00.101.10.101.20.101.30.101.40.102.00.103.00.104.00.104.10.105.00.106.0

+ 106 more Show less

0.107.00.108.00.108.10.108.20.108.30.109.00.109.10.110.00.110.10.110.20.111.00.112.00.113.00.113.10.114.00.115.00.115.10.116.00.117.00.117.10.17.10.65.30.65.40.66.00.66.10.66.20.67.00.68.00.68.10.68.20.68.30.68.40.69.00.70.00.70.10.70.20.70.30.70.40.71.00.72.00.72.10.72.20.72.30.72.40.72.50.72.60.72.70.73.00.73.10.73.20.74.00.75.00.75.10.75.20.76.00.77.00.77.10.78.00.79.00.79.10.79.20.79.30.80.00.81.00.82.00.83.00.83.10.83.20.83.30.83.40.84.00.84.10.84.20.85.00.85.10.86.00.86.10.86.20.86.30.86.40.87.00.87.10.87.20.88.00.88.10.88.20.88.30.89.00.90.00.90.10.90.20.91.00.91.10.91.20.91.30.92.00.92.10.93.00.94.00.94.10.95.00.96.00.97.00.98.00.98.10.99.0

Fixed in

0.117.2

References

https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/GHSA-8vh3-g2qg-2h2c
https://github.com/cbcoutinho/nextcloud-mcp-server/commit/4fc2b10945108cf1008ec9698291de6706ffcb73
https://github.com/cbcoutinho/nextcloud-mcp-server
https://github.com/cbcoutinho/nextcloud-mcp-server/tree/v0.117.2
https://pypi.org/project/nextcloud-mcp-server
https://github.com/advisories/GHSA-8vh3-g2qg-2h2c

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 123
patch 168

292 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More