Skip to content
OpenAdvisories

Vendor

rowboatlabs

4 known vulnerabilities.

Products

rowboat 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.0
    CVE-2026-86122

    Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

    Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forge…

    rowboatlabs rowboat
  • Medium 5.3
    CVE-2026-84856

    rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service

    A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in deni…

    rowboatlabs rowboat