CVE-2026-28474 - Vulnerability Analysis

Overview

OpenClaw Nextcloud Talk plugin < 2026.2.6 contains a broken access control caused by equality matching on mutable actor.name display name for allowlist validation, letting attackers bypass DM and room allowlists by impersonation, exploit requires attacker to change display name.

Severity & Score

Impact

Attackers can bypass allowlists and gain unauthorized access to restricted conversations, compromising confidentiality.

Mitigation

Update to version 2026.2.6 or later.

References

• https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d
• https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r
• https://www.vulncheck.com/advisories/openclaw-nextcloud-talk-allowlist-bypass-via-actorname-display-name-spoofing

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🔴 CVE-2026-28474 - Critical (9.8) OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28474/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner