Rowboatlabs Rowboat vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Rowboatlabs Rowboat: 3 record(s), with affected versions and fixes.

CVE-2026-86122 Medium · 5.0 CWE-918 Sep 5, 2026

Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.

CVE-2026-84856 Medium · 5.3 CWE-404 Sep 2, 2026

rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service

A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.

CVE-2026-6635 High · 7.3 CWE-287 Apr 20, 2026

rowboatlabs rowboat tools_webhook app.py tool_call improper authentication

A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool_call of the file apps/experimental/tools_webhook/app.py of the component tools_webhook. Such manipulation of the argument X-Tools-JWE leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.