CVE-2026-86122mediumCWE-918

CVE-2026-86122: medium-severity vulnerability in rowboatlabs rowboat

Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

Published · Updated

Follow this CVE+ Monitor rowboat

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
rowboatlabs · rowboat
Related CVEs — rowboatlabs rowboat

In the same product, most dangerous first.

CVE-2026-84856MEDIUMrowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of serviceEPSS 0.7%CVE-2026-6635MEDIUMrowboatlabs rowboat tools_webhook app.py tool_call improper authenticationEPSS 0.5%CVE-2025-7115MEDIUMrowboatlabs rowboat Session route.ts PUT missing authenticationEPSS 0.5%