Vulnerabilities

TI-2026-58921 CVE-2026-86122 · GHSA-jmxm-qmrf-xrpp

Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

LOW 24

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00372 Published 2026-09-05 No fix listed CWE-918

TI-2026-58340 CVE-2026-84856 · GHSA-66mr-2w7f-r56j

HIGH 70

A vulnerability was detected in rowboatlabs rowboat up to 0.9.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00701 Published 2026-09-02 Fixed in 0.9.2 CWE-404

TI-2026-05822 CVE-2026-6635 · GHSA-6c34-3mhj-jwxw

HIGH 70

A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00466 Published 2026-04-20 No fix listed CWE-287

TI-2025-06477 CVE-2025-7115 · GHSA-76x2-9gv6-f534

HIGH 70

A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00457 Published 2025-07-07 No fix listed CWE-287