CVE-2026-28474 — OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on…¶

Key facts

CVE-2026-28474 is a Critical (9.8) vulnerability: OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-28474
Severity	Critical (9.8)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-28474/

Details¶

CVE-2026-28474 is a Critical (9.8) vulnerability: OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-28474
CVSS Score	9.8

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-28474/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-28474

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d
https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r
https://www.vulncheck.com/advisories/openclaw-nextcloud-talk-allowlist-bypass-via-actorname-display-name-spoofing

Generated by PoC Generator on 2026-04-10T16:20:08.007642164

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-28474, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-28474 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-28474 OpenClaw Nextcloud Talk allowlist bypass attempt via display name manipulation"; flow:established,to_server; content:"POST"; http_method; content:"/ocs/v2.php/apps/spreed/api/"; http_uri; content:"displayname"; http_client_body; content:"actor"; http_client_body; pcre:"/displayname.*[\"'][\w\-\.]+[\"']/i"; sid:1000000; rev:1; classtype:web-application-attack; priority:2; reference:cve,CVE-2026-28474;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-28474 OpenClaw Nextcloud Talk display name change for allowlist bypass"; flow:established,to_server; content:"PUT"; http_method; content:"/ocs/v2.php/cloud/users/"; http_uri; content:"displayname"; http_client_body; pcre:"/displayname[\"']\s*:\s*[\"'][\w\-\.@]+[\"']/i"; sid:1000001; rev:1; classtype:web-application-attack; priority:2; reference:cve,CVE-2026-28474;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-28474 OpenClaw Nextcloud Talk room join attempt with suspicious display name"; flow:established,to_server; content:"POST"; http_method; content:"/ocs/v2.php/apps/spreed/api/"; http_uri; content:"participants"; http_uri; content:"User-Agent"; http_header; content:"displayName"; http_client_body; pcre:"/displayName.*[\"'][\w\-\.@]{3,}[\"']/i"; sid:1000002; rev:1; classtype:web-application-attack; priority:2; reference:cve,CVE-2026-28474;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-28474 OpenClaw Nextcloud Talk actor name equality bypass pattern"; flow:established,to_server; content:"/apps/spreed/"; http_uri; content:"actor"; http_client_body; content:"name"; http_client_body; pcre:"/actor[\"']\s*:\s*\{[^}]*name[\"']\s*:\s*[\"'][\w\-\.@]+[\"']/i"; sid:1000003; rev:1; classtype:web-application-attack; priority:2; reference:cve,CVE-2026-28474;)

:material-file-download: prevention/snort.rules

rule CVE_2026_28474_OpenClaw_Nextcloud_Talk_Bypass_Attempt {
    meta:
        cve = "CVE-2026-28474"
        author = "Security Engineer"
        description = "Detects potential exploitation of OpenClaw Nextcloud Talk plugin allowlist bypass vulnerability"
        date = "2024-12-19"
        version = "1.0"
        severity = "high"

    strings:
        $plugin_name1 = "OpenClaw" ascii nocase
        $plugin_name2 = "Nextcloud Talk" ascii nocase
        $plugin_name3 = "openclaw" ascii nocase

        $api_endpoint1 = "/ocs/v2.php/apps/spreed/api/" ascii
        $api_endpoint2 = "/apps/spreed/" ascii
        $api_endpoint3 = "spreed/api" ascii

        $actor_field1 = "actor.name" ascii
        $actor_field2 = "actorDisplayName" ascii
        $actor_field3 = "displayName" ascii
        $actor_field4 = "actor_name" ascii

        $allowlist_check1 = "allowlist" ascii nocase
        $allowlist_check2 = "whitelist" ascii nocase
        $allowlist_check3 = "allowed_users" ascii nocase
        $allowlist_check4 = "permitted_users" ascii nocase

        $bypass_pattern1 = /displayName["\s]*[:=]["\s]*[a-zA-Z0-9_\-@\.]+/ ascii
        $bypass_pattern2 = /actor\.name["\s]*[:=]["\s]*[a-zA-Z0-9_\-@\.]+/ ascii
        $bypass_pattern3 = /"name"\s*:\s*"[^"]*"/ ascii

        $http_method1 = "PUT /ocs/v2.php/cloud/users/" ascii
        $http_method2 = "PATCH /ocs/v2.php/cloud/users/" ascii
        $http_method3 = "POST /ocs/v2.php/apps/provisioning_api/api/v1/users/" ascii

        $suspicious_log1 = "display name changed" ascii nocase
        $suspicious_log2 = "allowlist validation" ascii nocase
        $suspicious_log3 = "unauthorized access" ascii nocase

        $version_check = /versions?\s+prior\s+to\s+2026\.2\.6/ ascii nocase

        $json_payload1 = /"displayname"\s*:\s*"[^"]*"/ ascii nocase
        $json_payload2 = /"display-name"\s*:\s*"[^"]*"/ ascii nocase

    condition:
        (
            (any of ($plugin_name*) and any of ($api_endpoint*)) or
            (any of ($actor_field*) and any of ($allowlist_check*)) or
            (any of ($bypass_pattern*) and any of ($http_method*)) or
            (any of ($suspicious_log*) and any of ($json_payload*))
        ) and (
            filesize < 10MB
        )
}

rule CVE_2026_28474_Nextcloud_Talk_Config_Exploitation {
    meta:
        cve = "CVE-2026-28474"
        author = "Security Engineer"
        description = "Detects configuration files or logs indicating OpenClaw Nextcloud Talk allowlist bypass exploitation"
        date = "2024-12-19"
        version = "1.0"
        severity = "medium"

    strings:
        $config_path1 = "nextcloud/apps/spreed/lib/" ascii
        $config_path2 = "openclaw" ascii nocase
        $config_path3 = "/var/www/nextcloud/" ascii

        $vulnerable_version1 = "2026.2.5" ascii
        $vulnerable_version2 = "2026.2.4" ascii
        $vulnerable_version3 = "2026.2.3" ascii
        $vulnerable_version4 = "2026.1." ascii

        $log_entry1 = "allowlist bypass" ascii nocase
        $log_entry2 = "display name manipulation" ascii nocase
        $log_entry3 = "unauthorized room access" ascii nocase
        $log_entry4 = "DM bypass" ascii nocase

        $exploit_indicator1 = "equality matching" ascii nocase
        $exploit_indicator2 = "mutable actor.name" ascii nocase
        $exploit_indicator3 = "display name field" ascii nocase

        $hex_pattern1 = { 61 63 74 6F 72 2E 6E 61 6D 65 } // "actor.name"
        $hex_pattern2 = { 64 69 73 70 6C 61 79 4E 61 6D 65 } // "displayName"
        $hex_pattern3 = { 61 6C 6C 6F 77 6C 69 73 74 } // "allowlist"

    condition:
        (
            any of ($config_path*) or
            any of ($vulnerable_version*) or
            any of ($log_entry*) or
            any of ($exploit_indicator*) or
            any of ($hex_pattern*)
        ) and filesize < 50MB
}

rule CVE_2026_28474_HTTP_Request_Exploitation {
    meta:
        cve = "CVE-2026-28474"
        author = "Security Engineer"
        description = "Detects HTTP requests attempting to exploit OpenClaw Nextcloud Talk allowlist bypass"
        date = "2024-12-19"
        version = "1.0"
        severity = "high"

    strings:
        $http_header1 = "User-Agent:" ascii nocase
        $http_header2 = "Content-Type: application/json" ascii nocase
        $http_header3 = "Authorization:" ascii nocase

        $nextcloud_api1 = "PUT /ocs/v2.php/cloud/users/" ascii
        $nextcloud_api2 = "GET /ocs/v2.php/apps/spreed/api/v4/room/" ascii
        $nextcloud_api3 = "POST /ocs/v2.php/apps/spreed/api/v4/room/" ascii

        $json_exploit1 = /\{\s*"displayname"\s*:\s*"[a-zA-Z0-9_\-@\.]+"\s*\}/ ascii nocase
        $json_exploit2 = /\{\s*"display-name"\s*:\s*"[a-zA-Z0-9_\-@\.]+"\s*\}/ ascii nocase
        $json_exploit3 = /"actor"\s*:\s*\{\s*"name"\s*:\s*"[^"]*"/ ascii

        $suspicious_ua = "curl/" ascii
        $suspicious_ua2 = "python-requests/" ascii
        $suspicious_ua3 = "Nextcloud-Talk-Bot" ascii

        $room_access = "/api/v4/room/" ascii
        $dm_access = "/api/v4/chat/" ascii
        $participant_api = "/participants/" ascii

    condition:
        (
            any of ($http_header*) and 
            (
                any of ($nextcloud_api*) or
                any of ($json_exploit*) or
                any of ($room_access, $dm_access, $participant_api)
            )
        ) or (
            any of ($suspicious_ua*) and any of ($json_exploit*)
        )
}

:material-file-download: prevention/yara.yar

# CVE-2026-28474 Prevention Rules
# Protect against OpenClaw Nextcloud Talk plugin allowlist bypass

# Block requests to Nextcloud Talk API endpoints with suspicious patterns
location ~* ^/ocs/v2\.php/apps/spreed/ {
    # Block requests with display name manipulation attempts
    if ($request_body ~* "displayName.*['\"](?:admin|root|system|user_\d+)['\"]") {
        return 403;
    }

    # Block requests attempting to modify actor.name field
    if ($request_body ~* "actor\.name.*['\"](?:[a-zA-Z0-9_-]+)['\"]") {
        return 403;
    }

    # Block requests with suspicious user ID patterns in body
    if ($request_body ~* "(?:userId|actorId|participantId).*['\"](?:admin|root|system)['\"]") {
        return 403;
    }

    # Rate limiting for Talk API endpoints
    limit_req zone=api_limit burst=10 nodelay;

    # Add security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;

    proxy_pass $backend;
}

# Protect Talk conversation endpoints specifically
location ~* ^/ocs/v2\.php/apps/spreed/api/v\d+/room/ {
    # Block attempts to join rooms with manipulated display names
    if ($request_body ~* "displayName.*(?:\x00|\x0a|\x0d|<|>|script|javascript)") {
        return 403;
    }

    # Block requests with multiple display name changes in succession
    if ($request_body ~* "displayName.*displayName") {
        return 403;
    }

    # Validate actor field modifications
    if ($request_body ~* "actor.*['\"](?:(?!^[a-zA-Z0-9._-]+$).)*['\"]") {
        return 403;
    }

    proxy_pass $backend;
}

# Protect user profile update endpoints
location ~* ^/ocs/v2\.php/cloud/users/[^/]+$ {
    # Block rapid display name changes that could indicate bypass attempts
    limit_req zone=profile_limit burst=3 nodelay;

    # Block display name changes to system-like usernames
    if ($request_body ~* "displayname.*['\"](?:admin|administrator|root|system|user_\d+|test|guest)['\"]") {
        return 403;
    }

    # Block special characters that might be used for bypassing
    if ($request_body ~* "displayname.*['\"][^a-zA-Z0-9\s._-]*['\"]") {
        return 403;
    }

    proxy_pass $backend;
}

# General protection for Nextcloud OCS API
location ~* ^/ocs/v2\.php/ {
    # Block requests with suspicious authorization headers
    if ($http_authorization ~* "(?:admin|root|system)") {
        return 403;
    }

    # Block requests attempting to impersonate system users
    if ($args ~* "(?:userId|user)=(?:admin|root|system)") {
        return 403;
    }

    # Add security headers for all OCS API requests
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options SAMEORIGIN;
    add_header Referrer-Policy strict-origin-when-cross-origin;

    proxy_pass $backend;
}

# Rate limiting zones (add to http block)
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/m;
limit_req_zone $binary_remote_addr zone=profile_limit:10m rate=5r/m;

:material-file-download: prevention/nginx.conf

# ModSecurity Rules for CVE-2026-28474: OpenClaw Nextcloud Talk Plugin Display Name Bypass
# Prevents exploitation of actor.name equality matching vulnerability

# Rule to detect Nextcloud Talk API endpoints
SecRule REQUEST_URI "@beginsWith /ocs/v2.php/apps/spreed/" \
    "id:1000001,\
    phase:1,\
    t:none,\
    t:lowercase,\
    pass,\
    nolog,\
    tag:'CVE-2026-28474',\
    tag:'nextcloud-talk',\
    setvar:'tx.nextcloud_talk_request=1'"

# Rule to detect potential display name manipulation in POST requests
SecRule REQUEST_METHOD "@streq POST" \
    "id:1000002,\
    phase:2,\
    chain,\
    t:none,\
    msg:'CVE-2026-28474: Potential Nextcloud Talk display name manipulation detected',\
    logdata:'URI: %{REQUEST_URI}, POST Data: %{ARGS}',\
    severity:'CRITICAL',\
    tag:'CVE-2026-28474',\
    tag:'nextcloud-talk',\
    tag:'display-name-bypass',\
    block"
    SecRule TX:NEXTCLOUD_TALK_REQUEST "@eq 1" \
        "t:none"
    SecRule ARGS "@rx (?i)(?:displayname|display.name|actor\.name)" \
        "t:none,\
        t:lowercase"

# Rule to detect suspicious display name patterns in JSON payloads
SecRule REQUEST_BODY "@rx (?i)\"(?:displayName|display_name|actor\.name)\"\s*:\s*\"[^\"]*(?:admin|root|system|test|user[0-9]+|guest)\"" \
    "id:1000003,\
    phase:2,\
    t:none,\
    t:lowercase,\
    msg:'CVE-2026-28474: Suspicious display name pattern in Nextcloud Talk request',\
    logdata:'URI: %{REQUEST_URI}, Body: %{REQUEST_BODY}',\
    severity:'HIGH',\
    tag:'CVE-2026-28474',\
    tag:'nextcloud-talk',\
    tag:'display-name-pattern',\
    block"

# Rule to detect allowlist bypass attempts via User-Agent or headers
SecRule REQUEST_HEADERS:User-Agent "@rx (?i)nextcloud.*talk" \
    "id:1000004,\
    phase:1,\
    chain,\
    t:none,\
    t:lowercase,\
    msg:'CVE-2026-28474: Nextcloud Talk user agent with suspicious display name manipulation',\
    logdata:'User-Agent: %{REQUEST_HEADERS.User-Agent}, URI: %{REQUEST_URI}',\
    severity:'MEDIUM',\
    tag:'CVE-2026-28474',\
    tag:'nextcloud-talk',\
    tag:'user-agent-bypass',\
    block"
    SecRule ARGS "@rx (?i)(?:name|displayname)\s*=\s*(?:admin|root|system|user[0-9]+)" \
        "t:none,\
        t:lowercase,\
        t:urlDecode"

# Rule to monitor for rapid display name changes
SecRule REQUEST_URI "@beginsWith /ocs/v2.php/apps/provisioning_api/api/v1/config/users/" \
    "id:1000005,\
    phase:1,\
    t:none,\
    t:lowercase,\
    pass,\
    msg:'CVE-2026-28474: Monitoring Nextcloud user profile changes',\
    logdata:'URI: %{REQUEST_URI}, IP: %{REMOTE_ADDR}',\
    severity:'INFO',\
    tag:'CVE-2026-28474',\
    tag:'profile-monitoring',\
    setvar:'ip.profile_changes=+1',\
    expirevar:'ip.profile_changes=300'"

# Rule to block excessive profile modification attempts
SecRule IP:PROFILE_CHANGES "@gt 5" \
    "id:1000006,\
    phase:1,\
    t:none,\
    msg:'CVE-2026-28474: Excessive profile modification attempts detected',\
    logdata:'IP: %{REMOTE_ADDR}, Attempts: %{IP.PROFILE_CHANGES}',\
    severity:'HIGH',\
    tag:'CVE-2026-28474',\
    tag:'rate-limiting',\
    block,\
    setvar:'ip.blocked=1',\
    expirevar:'ip.blocked=3600'"

# Rule to detect version-specific vulnerable endpoints
SecRule REQUEST_URI "@rx /ocs/v2\.php/apps/spreed/api/v[1-4]/room/[^/]+/participants" \
    "id:1000007,\
    phase:1,\
    t:none,\
    t:lowercase,\
    pass,\
    msg:'CVE-2026-28474: Access to potentially vulnerable Nextcloud Talk participants endpoint',\
    logdata:'URI: %{REQUEST_URI}, Method: %{REQUEST_METHOD}',\
    severity:'MEDIUM',\
    tag:'CVE-2026-28474',\
    tag:'vulnerable-endpoint',\
    setvar:'tx.vulnerable_endpoint=1'"

# Rule to block requests with known bypass patterns
SecRule ARGS "@rx (?i)(?:actor|participant)(?:\.|_)?(?:name|displayname)\s*(?:=|:)\s*['\"]?(?:[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}|user[0-9]+|admin|system)['\"]?" \
    "id:1000008,\
    phase:2,\
    t:none,\
    t:lowercase,\
    t:urlDecode,\
    msg:'CVE-2026-28474: Detected display name bypass pattern matching user ID format',\
    logdata:'Matched Pattern: %{MATCHED_VAR}, URI: %{REQUEST_URI}',\
    severity:'CRITICAL',\
    tag:'CVE-2026-28474',\
    tag:'bypass-pattern',\
    block"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-28474?¶

CVE-2026-28474 is a Critical (9.8) vulnerability: OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-28474?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-28474?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.