nextcloud-mcp-server vulnerabilities

CVEs whose affected-version data names the nextcloud-mcp-server package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-55640Critical· 9.1

4w ago

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( d…

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

▾ Midnightnextcloud-mcp-server · nextcloud-mcp-serverEPSS 0.48%via OSV