Nextcloud MCP Server Unauthenticated Webhook Leads to Vector Index Manipulation

Technical Analysis

The POST /webhooks/nextcloud endpoint in webhook_receiver.py performs no authentication check when WEBHOOK_SECRET is unset, and startup validation does not enforce its presence, so the server ships insecure-by-default. The webhook_parser.py module trusts the attacker-supplied payload["user"]["uid"] field without cross-checking it against an authenticated session, allowing the caller to impersonate any Nextcloud user. This uid is then used to drive Qdrant vector store operations (deletion and re-indexing), so a remote attacker can selectively destroy or corrupt semantic search embeddings for arbitrary users. The vulnerability crosses the boundary between an external, unauthenticated network interface and the AI agent's internal memory/retrieval layer, enabling a form of remote memory poisoning/denial-of-service against RAG-based agent workflows built on this MCP server.

Affected Systems

Nextcloud MCP Server; protocols: MCP

Detection Signatures

• Unauthenticated POST requests to /webhooks/nextcloud endpoint
• WEBHOOK_SECRET environment variable unset or empty in deployment config
• Webhook payloads with user.uid values inconsistent with any authenticated session
• Unexpected Qdrant collection deletions or bulk re-indexing events not correlated with legitimate Nextcloud activity
• Spike in vector store write/delete API calls from unexpected source IPs

Remediation Steps

1. 1

   Upgrade immediately

   Update Nextcloud MCP Server to version 0.117.2 or later, which fixes the default-authentication bypass.

2. 2

   Enforce WEBHOOK_SECRET

   Explicitly configure a strong WEBHOOK_SECRET value and ensure startup validation rejects deployment if it is unset; do not rely on defaults.

3. 3

   Validate user identity server-side

   Cross-check payload-provided user identifiers against an authenticated session or signed webhook token rather than trusting client-supplied fields.

4. 4

   Network restrict webhook endpoint

   Limit inbound access to the webhook endpoint via firewall/allowlisting to only the trusted Nextcloud instance IP range.

5. 5

   Monitor vector store integrity

   Add alerting for anomalous deletion or re-indexing operations in Qdrant and maintain backups of embeddings to enable recovery from destructive events.