CVE-2026-28474 OpenClaw CVE debrief

Who should care

Defenders responsible for Nextcloud Talk plugin deployments should assess exposure and prioritize patching to prevent allowlist bypass via actor.name display name spoofing. This includes reviewing and updating allowlists, monitoring for suspicious activity, and ensuring that all users are aware of the potential vulnerability and the importance of secure display name practices.

Why it matters

CVE-2026-28474 allows attackers to bypass allowlists in OpenClaw's Nextcloud Talk plugin by spoofing display names, potentially leading to unauthorized access and privilege escalation. Defenders should prioritize patching and monitoring for suspicious activity.

• Potential unauthorized access to restricted conversations.
• Bypassing of DM and room allowlists.
• Elevation of privileges for attackers.
• Need for verification and patching of vulnerable plugin versions.

Technical summary

OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 are vulnerable to allowlist bypass via actor.name display name spoofing. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations. This vulnerability allows attackers to bypass DM and room allowlists, potentially leading to unauthorized access and privilege escalation. The vulnerability is due to equality matching on the mutable actor.name display name field for allowlist validation.

Defensive priority

Defenders should prioritize verifying and applying the patch (version 2026.2.6 or later) for OpenClaw's Nextcloud Talk plugin to prevent allowlist bypass via actor.name display name spoofing.

Recommended defensive actions

• Verify and apply the patch (version 2026.2.6 or later) for OpenClaw's Nextcloud Talk plugin.
• Restrict access to sensitive conversations and user accounts.
• Monitor for suspicious activity and changes to user display names.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6. The vulnerability allows attackers to bypass DM and room allowlists by changing their Nextcloud display name to match an allowlisted user ID.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.