CVE-2026-28474
1 advisory.
npm/@openclaw/nextcloud-talk CVE-2026-28474: critical
Nextcloud Talk allowlist bypass via actor.name display name spoofing
Action: Upgrade @openclaw/nextcloud-talk to 2026.2.6 or later.
npm i @openclaw/nextcloud-talk@2026.2.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2026.2.6 | - |
Fixed versions
| 2026.2.6 |
Sources
- osv: GHSA-r5h9-vjqc-hq3r
- https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r
- https://github.com/openclaw/openclaw/commit/660f87278c9f292061e097441e0b10c20d62b31b
- https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d
- https://github.com/openclaw/openclaw
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.3
CVE-2026-28474 · published · modified · JSON