{"action":"Upgrade @openclaw/nextcloud-talk to 2026.2.6 or later.","affected":[{"fixed":"2026.2.6","introduced":"0"}],"component":"@openclaw/nextcloud-talk","cve_ids":["CVE-2026-28474"],"ecosystem":"npm","epss":0.00502,"exploited":false,"fixed_versions":["2026.2.6"],"ghsa_id":"GHSA-r5h9-vjqc-hq3r","id":"tcs_01M5KG81PKCK2SRVP0XW5R99CS","modified_at":"2026-03-05T22:11:22.531720Z","published_at":"2026-02-17T21:36:15Z","references":["https://osv.dev/vulnerability/GHSA-r5h9-vjqc-hq3r","https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r","https://github.com/openclaw/openclaw/commit/660f87278c9f292061e097441e0b10c20d62b31b","https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.2.3"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-r5h9-vjqc-hq3r","url":"https://osv.dev/vulnerability/GHSA-r5h9-vjqc-hq3r"}],"summary":"Nextcloud Talk allowlist bypass via actor.name display name spoofing"}