CVE-2023-49105: CISA Adds ownCloud Auth Bypass to KEV After Nuclear Data Theft

Executive Summary

CVE-2023-49105, a critical improper-authentication flaw in ownCloud Server, was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on August 27, 2026 alongside a Linux kernel bug and a JFrog Artifactory flaw. The nearly three-year-old vulnerability lets an attacker who knows a victim's username read, modify, or delete any file in that user's ownCloud instance without authentication, exploiting how the WebDAV API validates pre-signed URLs when no signing key has been configured — which is the default state for most accounts.

CVSS Score: 9.8 (Critical)

The KEV addition follows disclosure of a real-world incident: suspected Chinese-speaking operators used this exact flaw to steal roughly 9 GB of sensitive data — including research-reactor core-component databases and radiation-safety documentation — from a Philippine nuclear research organization.

Vulnerability Overview

How the Bypass Works

ownCloud's WebDAV API supports pre-signed URLs — temporary, signature-based links that grant file access without requiring a login. Each user is meant to have a signing key that ownCloud uses to validate these signatures.

The flaw: if a user has no signing key configured (the default for most accounts), ownCloud's server code still accepts pre-signed requests for that user — validating the signature against an empty secret. An attacker who knows only a target's username can:

1. Craft a WebDAV request with the OC-Credential header set to the victim's username
2. Generate a valid signature using the empty secret
3. Send the forged request to read, write, or delete any file the victim can access

No password, session token, or prior access is required. Researchers have also demonstrated chaining this bypass into remote code execution on vulnerable instances.

Active Exploitation: Philippine Nuclear Research Agency Breach

The KEV listing follows public disclosure of a targeted intrusion first reported by threat-intel firm Hunt.io:

• Hunt.io discovered an exposed attacker-operated file directory on an Amsterdam-hosted server on August 13, 2026, containing 1,310 files across 86 subdirectories — including custom exploit scripts, exfiltration logs, and stolen data.
• The trove included research-reactor core-component databases, historical fuel-inventory records, radiation-safety documentation, and authorized-user lists, plus personnel résumés and passport documents — roughly 9 GB total.
• A second target, a Philippine marine engineering and shipbuilding firm supporting the Philippine Navy, was compromised via a separate WordPress flaw (CVE-2024-28000 in LiteSpeed Cache).
• Recovered Python tooling set the OC-Credential header to a target username, forged a valid signature against the empty secret, and pulled data via WebDAV PROPFIND/GET requests — deliberately inserting 1.5-to-6-second delays between requests to evade detection.
• Hunt.io disclosed the findings to CERT-PH under TLP:AMBER and delayed public release until August 25, 2026 to allow coordinated notification.
• Hunt.io assesses with medium confidence that suspected Chinese-speaking operators conducted targeted intelligence collection rather than opportunistic exploitation, though no specific threat group has been named.

Why This Matters Now

Recommended Actions

1. Upgrade immediately — update owncloud/core to version 10.13.1 or later, which rejects pre-signed URL requests when no signing key is configured.
2. Configure signing keys for every account as defense in depth, even after patching.
3. Audit WebDAV access logs for PROPFIND/GET/PUT requests carrying an OC-Credential header for usernames that never authenticated normally.
4. Rotate credentials and encryption keys for any instance that was internet-reachable and unpatched, given confirmed exploitation.
5. Federal agencies: track this addition against BOD 26-04 remediation deadlines.

References

• CISA — Adds Three Known Exploited Vulnerabilities to Catalog
• GreyNoise — CVE-2023-49105, WebDAV API Authentication Bypass in ownCloud

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• Zimbra ZCS OS Command Injection — CVE-2026-73570