CVE-2026-84856mediumCWE-404

CVE-2026-84856: falha de média gravidade em rowboatlabs rowboat

rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rowboat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 6.9epss 0.7%
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
rowboatlabs · rowboat
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — rowboatlabs rowboat

No mesmo produto, das mais perigosas para as menos.

CVE-2026-6635MEDIUMrowboatlabs rowboat tools_webhook app.py tool_call improper authenticationEPSS 0.5%CVE-2025-7115MEDIUMrowboatlabs rowboat Session route.ts PUT missing authenticationEPSS 0.5%CVE-2026-86122MEDIUMRowboat through 0.9.1 Server-Side Request Forgery via Custom MCP ServerEPSS 0.4%