Warning: Multiple critical vulnerabilities in OpenClaw's Nextcloud Talk plugin, Patch Immediately!

• Last update: 06/03/2026
• Affected software:
  → OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6
• Type:
  → CWE-863: Incorrect Authorization
  → CWE-184: Incomplete List of Disallowed Inputs
  → CWE-303: Incorrect Implementation of Authentication Algorithm
  → CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
  → CWE-306: Missing Authentication for Critical Function
  → CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

• CVE/CVSS
  → CVE-2026-28474: CVSS 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
  
  → CVE-2026-28466: CVSS 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
  
  → CVE-2026-28391: CVSS 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
  
  → CVE-2026-28446: CVSS 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)
  
  → CVE-2026-28470: CVSS 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
  
  → CVE-2026-28472: CVSS 9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
  
  → CVE-2026-28484: CVSS 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

Sources

Github OpenClaw - https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r

Risks

OpenClaw’s Nextcloud integration lets the self-hosted OpenClaw AI agent manage Nextcloud files, calendars, tasks, and Deck boards via APIs like WebDAV/CalDAV. The Talk plugin adds a webhook bot to Nextcloud Talk chats for real-time AI responses in direct messages or group rooms.

OpenClaw revealed seven new critical vulnerabilities on the 5th of March 2026 (CVE-2026-28474, CVE-2026-28466, CVE-2026-28391, CVE-2026-28446, CVE-2026-28470, CVE-2026-28472, CVE-2026-28484) that affect the OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6.

There is no sign of active exploitation of any of the vulnerabilities, as well as no sign of any publicly available proof-of-concept.

Exploitation of any of those vulnerabilities can have a high impact on the confidentiality, integrity and availability of the system.

Description

CVE-2026-28474: A remote, unauthenticated attacker without any privileges or user interaction can exploit this vulnerability that stems from incorrect authorization to gain unauthorized access to restricted conversations.

CVE-2026-28466: A remote attacker with low privileges and without user interaction can exploit this incorrect authorization vulnerability to execute arbitrary commands and compromise developer workstations and CI runners.

CVE-2026-28391: A remote attacker without any privileges or user interaction can exploit this vulnerability that stems from an incomplete list of disallowed inputs to bypass command approval restrictions execute unapproved commands.

CVE-2026-28446: A remote attacker without any privileges or user interaction can exploit this vulnerability that stems from an incorrect implementation of authentication algorithm to bypass inbound access controls to execute tools without authorization.

CVE-2026-28470: A remote attacker without any privileges or user interaction can exploit this vulnerability to bypass the allowlist protection by injecting command substitution syntax to execute arbitrary commands without authorization.

CVE-2026-28472: A remote attacker without any privileges or user interaction can exploit this vulnerability to gain access to the gateway without providing device identity or pairing and gain operator access in vulnerable deployments.

CVE-2026-28484: A remote attacker without any privileges or user interaction can exploit this vulnerability and inject commands and specifically git flags through specially crafted filenames and add sensitive ignored files like env files to git history. This creates the risk that sensitive files might become exposed in version control and accessible to unauthorized parties.

Recommended Actions

Patch
The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

Monitor/Detect
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via https://ccb.belgium.be/en/cert/report-incident.

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

References

NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-28474
NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-28466
NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-28391
NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-28446
NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-28470
NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-28472
NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-28484