Search
Find a vulnerability
Search criteria
8 vulnerabilities by rowboatlabs
CVE-2026-86122 (GCVE-0-2026-86122)
Vulnerability from nvd – Published: 2026-09-05 09:59 – Updated: 2026-09-05 09:59
VLAI
EPSS
VEX
Title
Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server
Summary
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rowboatlabs/rowboat/issues/621 | issue-tracking |
| https://github.com/rowboatlabs/rowboat/blob/v0.9.… | technical-description |
| https://github.com/rowboatlabs/rowboat/blob/v0.9.… | technical-description |
| https://github.com/rowboatlabs/rowboat | product |
| https://www.vulncheck.com/advisories/rowboat-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rowboatlabs | rowboat |
Affected:
0 , ≤ 0.9.1
(semver)
|
Date Public
2026-06-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/rowboatlabs/rowboat",
"product": "rowboat",
"repo": "https://github.com/rowboatlabs/rowboat",
"vendor": "rowboatlabs",
"versions": [
{
"lessThanOrEqual": "0.9.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T09:59:10.757Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #621",
"tags": [
"issue-tracking"
],
"url": "https://github.com/rowboatlabs/rowboat/issues/621"
},
{
"name": "validateHttpHttpsUrl scheme-only check",
"tags": [
"technical-description"
],
"url": "https://github.com/rowboatlabs/rowboat/blob/v0.9.1/apps/rowboat/src/application/use-cases/projects/add-custom-mcp-server.use-case.ts"
},
{
"name": "Unvalidated webhook fetch and MCP client connect",
"tags": [
"technical-description"
],
"url": "https://github.com/rowboatlabs/rowboat/blob/v0.9.1/apps/rowboat/src/application/lib/agents-runtime/agent-tools.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/rowboatlabs/rowboat"
},
{
"name": "VulnCheck Advisory: Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rowboat-through-0.9.1-server-side-request-forgery-via-custom-mcp-server"
}
],
"title": "Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86122",
"datePublished": "2026-09-05T09:59:10.757Z",
"dateReserved": "2026-09-05T01:59:23.139Z",
"dateUpdated": "2026-09-05T09:59:10.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84856 (GCVE-0-2026-84856)
Vulnerability from nvd – Published: 2026-09-02 19:45 – Updated: 2026-09-03 14:31
VLAI
EPSS
VEX
Title
rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service
Summary
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 13:31 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398131 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/398131/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-84856 | third-party-advisory |
| https://vuldb.com/submit/886260 | third-party-advisory |
| https://github.com/hackerguopeng/cve/tree/main/Ro… | exploit |
| https://github.com/rowboatlabs/rowboat/releases/t… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rowboatlabs | rowboat |
Affected:
0.9.0
Affected: 0.9.1 Unaffected: 0.9.2 cpe:2.3:a:rowboatlabs:rowboat:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84856",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T13:31:43.906524Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:31:07.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rowboatlabs:rowboat:*:*:*:*:*:*:*:*"
],
"modules": [
"Composio Webhook Endpoint"
],
"product": "rowboat",
"vendor": "rowboatlabs",
"versions": [
{
"status": "affected",
"version": "0.9.0"
},
{
"status": "affected",
"version": "0.9.1"
},
{
"status": "unaffected",
"version": "0.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hackerguopeng (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T19:45:08.510Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398131 | rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/398131"
},
{
"name": "VDB-398131 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398131/cti"
},
{
"name": "CVE-2026-84856 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-84856"
},
{
"name": "Submit #886260 | Rowboat Labs Rowboat 0.1.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886260"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/hackerguopeng/cve/tree/main/Rowboat_PreAuth_Body_Buffer_DoS_Report"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rowboatlabs/rowboat/releases/tag/v0.9.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T15:26:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-84856",
"datePublished": "2026-09-02T19:45:08.510Z",
"dateReserved": "2026-09-02T13:21:31.887Z",
"dateUpdated": "2026-09-03T14:31:07.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6635 (GCVE-0-2026-6635)
Vulnerability from nvd – Published: 2026-04-20 11:45 – Updated: 2026-04-20 13:26
VLAI
EPSS
VEX
Title
rowboatlabs rowboat tools_webhook app.py tool_call improper authentication
Summary
A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool_call of the file apps/experimental/tools_webhook/app.py of the component tools_webhook. Such manipulation of the argument X-Tools-JWE leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-20 13:26 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/358269 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/358269/cti | signaturepermissions-required |
| https://vuldb.com/submit/793433 | third-party-advisory |
| https://github.com/Dave-gilmore-aus/security-advi… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rowboatlabs | rowboat |
Affected:
0.1.0
Affected: 0.1.1 Affected: 0.1.2 Affected: 0.1.3 Affected: 0.1.4 Affected: 0.1.5 Affected: 0.1.6 Affected: 0.1.7 Affected: 0.1.8 Affected: 0.1.9 Affected: 0.1.10 Affected: 0.1.11 Affected: 0.1.12 Affected: 0.1.13 Affected: 0.1.14 Affected: 0.1.15 Affected: 0.1.16 Affected: 0.1.17 Affected: 0.1.18 Affected: 0.1.19 Affected: 0.1.20 Affected: 0.1.21 Affected: 0.1.22 Affected: 0.1.23 Affected: 0.1.24 Affected: 0.1.25 Affected: 0.1.26 Affected: 0.1.27 Affected: 0.1.28 Affected: 0.1.29 Affected: 0.1.30 Affected: 0.1.31 Affected: 0.1.32 Affected: 0.1.33 Affected: 0.1.34 Affected: 0.1.35 Affected: 0.1.36 Affected: 0.1.37 Affected: 0.1.38 Affected: 0.1.39 Affected: 0.1.40 Affected: 0.1.41 Affected: 0.1.42 Affected: 0.1.43 Affected: 0.1.44 Affected: 0.1.45 Affected: 0.1.46 Affected: 0.1.47 Affected: 0.1.48 Affected: 0.1.49 Affected: 0.1.50 Affected: 0.1.51 Affected: 0.1.52 Affected: 0.1.53 Affected: 0.1.54 Affected: 0.1.55 Affected: 0.1.56 Affected: 0.1.57 Affected: 0.1.58 Affected: 0.1.59 Affected: 0.1.60 Affected: 0.1.61 Affected: 0.1.62 Affected: 0.1.63 Affected: 0.1.64 Affected: 0.1.65 Affected: 0.1.66 Affected: 0.1.67 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-20T13:26:25.301774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T13:26:31.802Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"tools_webhook"
],
"product": "rowboat",
"vendor": "rowboatlabs",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "affected",
"version": "0.1.1"
},
{
"status": "affected",
"version": "0.1.2"
},
{
"status": "affected",
"version": "0.1.3"
},
{
"status": "affected",
"version": "0.1.4"
},
{
"status": "affected",
"version": "0.1.5"
},
{
"status": "affected",
"version": "0.1.6"
},
{
"status": "affected",
"version": "0.1.7"
},
{
"status": "affected",
"version": "0.1.8"
},
{
"status": "affected",
"version": "0.1.9"
},
{
"status": "affected",
"version": "0.1.10"
},
{
"status": "affected",
"version": "0.1.11"
},
{
"status": "affected",
"version": "0.1.12"
},
{
"status": "affected",
"version": "0.1.13"
},
{
"status": "affected",
"version": "0.1.14"
},
{
"status": "affected",
"version": "0.1.15"
},
{
"status": "affected",
"version": "0.1.16"
},
{
"status": "affected",
"version": "0.1.17"
},
{
"status": "affected",
"version": "0.1.18"
},
{
"status": "affected",
"version": "0.1.19"
},
{
"status": "affected",
"version": "0.1.20"
},
{
"status": "affected",
"version": "0.1.21"
},
{
"status": "affected",
"version": "0.1.22"
},
{
"status": "affected",
"version": "0.1.23"
},
{
"status": "affected",
"version": "0.1.24"
},
{
"status": "affected",
"version": "0.1.25"
},
{
"status": "affected",
"version": "0.1.26"
},
{
"status": "affected",
"version": "0.1.27"
},
{
"status": "affected",
"version": "0.1.28"
},
{
"status": "affected",
"version": "0.1.29"
},
{
"status": "affected",
"version": "0.1.30"
},
{
"status": "affected",
"version": "0.1.31"
},
{
"status": "affected",
"version": "0.1.32"
},
{
"status": "affected",
"version": "0.1.33"
},
{
"status": "affected",
"version": "0.1.34"
},
{
"status": "affected",
"version": "0.1.35"
},
{
"status": "affected",
"version": "0.1.36"
},
{
"status": "affected",
"version": "0.1.37"
},
{
"status": "affected",
"version": "0.1.38"
},
{
"status": "affected",
"version": "0.1.39"
},
{
"status": "affected",
"version": "0.1.40"
},
{
"status": "affected",
"version": "0.1.41"
},
{
"status": "affected",
"version": "0.1.42"
},
{
"status": "affected",
"version": "0.1.43"
},
{
"status": "affected",
"version": "0.1.44"
},
{
"status": "affected",
"version": "0.1.45"
},
{
"status": "affected",
"version": "0.1.46"
},
{
"status": "affected",
"version": "0.1.47"
},
{
"status": "affected",
"version": "0.1.48"
},
{
"status": "affected",
"version": "0.1.49"
},
{
"status": "affected",
"version": "0.1.50"
},
{
"status": "affected",
"version": "0.1.51"
},
{
"status": "affected",
"version": "0.1.52"
},
{
"status": "affected",
"version": "0.1.53"
},
{
"status": "affected",
"version": "0.1.54"
},
{
"status": "affected",
"version": "0.1.55"
},
{
"status": "affected",
"version": "0.1.56"
},
{
"status": "affected",
"version": "0.1.57"
},
{
"status": "affected",
"version": "0.1.58"
},
{
"status": "affected",
"version": "0.1.59"
},
{
"status": "affected",
"version": "0.1.60"
},
{
"status": "affected",
"version": "0.1.61"
},
{
"status": "affected",
"version": "0.1.62"
},
{
"status": "affected",
"version": "0.1.63"
},
{
"status": "affected",
"version": "0.1.64"
},
{
"status": "affected",
"version": "0.1.65"
},
{
"status": "affected",
"version": "0.1.66"
},
{
"status": "affected",
"version": "0.1.67"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "davidgilmore (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool_call of the file apps/experimental/tools_webhook/app.py of the component tools_webhook. Such manipulation of the argument X-Tools-JWE leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T11:45:12.769Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-358269 | rowboatlabs rowboat tools_webhook app.py tool_call improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/358269"
},
{
"name": "VDB-358269 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/358269/cti"
},
{
"name": "Submit #793433 | Rowboat Labs Rowboat 0.1.67 Authentication Bypass Issues",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/793433"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Dave-gilmore-aus/security-advisories/blob/main/rowbat-advisory"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-19T21:25:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "rowboatlabs rowboat tools_webhook app.py tool_call improper authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-6635",
"datePublished": "2026-04-20T11:45:12.769Z",
"dateReserved": "2026-04-19T19:20:06.278Z",
"dateUpdated": "2026-04-20T13:26:31.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7115 (GCVE-0-2025-7115)
Vulnerability from nvd – Published: 2025-07-07 06:02 – Updated: 2025-07-07 16:47
VLAI
EPSS
VEX
Title
rowboatlabs rowboat Session route.ts PUT missing authentication
Summary
A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/[fileId]/route.ts of the component Session Handler. The manipulation of the argument params leads to missing authentication. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is expected that this issue will be fixed in the near future.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-07 16:35 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.315026 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.315026 | signaturepermissions-required |
| https://vuldb.com/?submit.604899 | third-party-advisory |
| https://github.com/rowboatlabs/rowboat/issues/166 | issue-tracking |
| https://github.com/rowboatlabs/rowboat/issues/166… | issue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rowboatlabs | rowboat |
Affected:
8096eaf63b5a0732edd8f812bee05b78e214ee97
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7115",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-07T16:35:43.534597Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-07T16:47:16.206Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Session Handler"
],
"product": "rowboat",
"vendor": "rowboatlabs",
"versions": [
{
"status": "affected",
"version": "8096eaf63b5a0732edd8f812bee05b78e214ee97"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/[fileId]/route.ts of the component Session Handler. The manipulation of the argument params leads to missing authentication. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is expected that this issue will be fixed in the near future."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in rowboatlabs rowboat bis 8096eaf63b5a0732edd8f812bee05b78e214ee97 ausgemacht. Es geht hierbei um die Funktion PUT der Datei apps/rowboat/app/api/uploads/[fileId]/route.ts der Komponente Session Handler. Durch Manipulieren des Arguments params mit unbekannten Daten kann eine missing authentication-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Dieses Produkt verzichtet auf eine Versionierung und verwendet stattdessen Rolling Releases. Deshalb sind keine Details zu betroffenen oder zu aktualisierende Versionen vorhanden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-07T06:02:07.544Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-315026 | rowboatlabs rowboat Session route.ts PUT missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.315026"
},
{
"name": "VDB-315026 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.315026"
},
{
"name": "Submit #604899 | Rowboat Labs RowBoat git checkout 8096eaf63b5a0732edd8f812bee05b78e214ee97 Unauthorized file upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.604899"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/rowboatlabs/rowboat/issues/166"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/rowboatlabs/rowboat/issues/166#issuecomment-2995195594"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-07-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-07-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-07-06T07:57:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "rowboatlabs rowboat Session route.ts PUT missing authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-7115",
"datePublished": "2025-07-07T06:02:07.544Z",
"dateReserved": "2025-07-06T05:52:09.457Z",
"dateUpdated": "2025-07-07T16:47:16.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-86122 (GCVE-0-2026-86122)
Vulnerability from cvelistv5 – Published: 2026-09-05 09:59 – Updated: 2026-09-05 09:59
VLAI
EPSS
VEX
Title
Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server
Summary
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rowboatlabs/rowboat/issues/621 | issue-tracking |
| https://github.com/rowboatlabs/rowboat/blob/v0.9.… | technical-description |
| https://github.com/rowboatlabs/rowboat/blob/v0.9.… | technical-description |
| https://github.com/rowboatlabs/rowboat | product |
| https://www.vulncheck.com/advisories/rowboat-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rowboatlabs | rowboat |
Affected:
0 , ≤ 0.9.1
(semver)
|
Date Public
2026-06-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/rowboatlabs/rowboat",
"product": "rowboat",
"repo": "https://github.com/rowboatlabs/rowboat",
"vendor": "rowboatlabs",
"versions": [
{
"lessThanOrEqual": "0.9.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T09:59:10.757Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #621",
"tags": [
"issue-tracking"
],
"url": "https://github.com/rowboatlabs/rowboat/issues/621"
},
{
"name": "validateHttpHttpsUrl scheme-only check",
"tags": [
"technical-description"
],
"url": "https://github.com/rowboatlabs/rowboat/blob/v0.9.1/apps/rowboat/src/application/use-cases/projects/add-custom-mcp-server.use-case.ts"
},
{
"name": "Unvalidated webhook fetch and MCP client connect",
"tags": [
"technical-description"
],
"url": "https://github.com/rowboatlabs/rowboat/blob/v0.9.1/apps/rowboat/src/application/lib/agents-runtime/agent-tools.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/rowboatlabs/rowboat"
},
{
"name": "VulnCheck Advisory: Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rowboat-through-0.9.1-server-side-request-forgery-via-custom-mcp-server"
}
],
"title": "Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86122",
"datePublished": "2026-09-05T09:59:10.757Z",
"dateReserved": "2026-09-05T01:59:23.139Z",
"dateUpdated": "2026-09-05T09:59:10.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84856 (GCVE-0-2026-84856)
Vulnerability from cvelistv5 – Published: 2026-09-02 19:45 – Updated: 2026-09-03 14:31
VLAI
EPSS
VEX
Title
rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service
Summary
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 13:31 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398131 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/398131/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-84856 | third-party-advisory |
| https://vuldb.com/submit/886260 | third-party-advisory |
| https://github.com/hackerguopeng/cve/tree/main/Ro… | exploit |
| https://github.com/rowboatlabs/rowboat/releases/t… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rowboatlabs | rowboat |
Affected:
0.9.0
Affected: 0.9.1 Unaffected: 0.9.2 cpe:2.3:a:rowboatlabs:rowboat:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84856",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T13:31:43.906524Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:31:07.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rowboatlabs:rowboat:*:*:*:*:*:*:*:*"
],
"modules": [
"Composio Webhook Endpoint"
],
"product": "rowboat",
"vendor": "rowboatlabs",
"versions": [
{
"status": "affected",
"version": "0.9.0"
},
{
"status": "affected",
"version": "0.9.1"
},
{
"status": "unaffected",
"version": "0.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hackerguopeng (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T19:45:08.510Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398131 | rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/398131"
},
{
"name": "VDB-398131 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398131/cti"
},
{
"name": "CVE-2026-84856 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-84856"
},
{
"name": "Submit #886260 | Rowboat Labs Rowboat 0.1.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886260"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/hackerguopeng/cve/tree/main/Rowboat_PreAuth_Body_Buffer_DoS_Report"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rowboatlabs/rowboat/releases/tag/v0.9.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T15:26:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-84856",
"datePublished": "2026-09-02T19:45:08.510Z",
"dateReserved": "2026-09-02T13:21:31.887Z",
"dateUpdated": "2026-09-03T14:31:07.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6635 (GCVE-0-2026-6635)
Vulnerability from cvelistv5 – Published: 2026-04-20 11:45 – Updated: 2026-04-20 13:26
VLAI
EPSS
VEX
Title
rowboatlabs rowboat tools_webhook app.py tool_call improper authentication
Summary
A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool_call of the file apps/experimental/tools_webhook/app.py of the component tools_webhook. Such manipulation of the argument X-Tools-JWE leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-20 13:26 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/358269 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/358269/cti | signaturepermissions-required |
| https://vuldb.com/submit/793433 | third-party-advisory |
| https://github.com/Dave-gilmore-aus/security-advi… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rowboatlabs | rowboat |
Affected:
0.1.0
Affected: 0.1.1 Affected: 0.1.2 Affected: 0.1.3 Affected: 0.1.4 Affected: 0.1.5 Affected: 0.1.6 Affected: 0.1.7 Affected: 0.1.8 Affected: 0.1.9 Affected: 0.1.10 Affected: 0.1.11 Affected: 0.1.12 Affected: 0.1.13 Affected: 0.1.14 Affected: 0.1.15 Affected: 0.1.16 Affected: 0.1.17 Affected: 0.1.18 Affected: 0.1.19 Affected: 0.1.20 Affected: 0.1.21 Affected: 0.1.22 Affected: 0.1.23 Affected: 0.1.24 Affected: 0.1.25 Affected: 0.1.26 Affected: 0.1.27 Affected: 0.1.28 Affected: 0.1.29 Affected: 0.1.30 Affected: 0.1.31 Affected: 0.1.32 Affected: 0.1.33 Affected: 0.1.34 Affected: 0.1.35 Affected: 0.1.36 Affected: 0.1.37 Affected: 0.1.38 Affected: 0.1.39 Affected: 0.1.40 Affected: 0.1.41 Affected: 0.1.42 Affected: 0.1.43 Affected: 0.1.44 Affected: 0.1.45 Affected: 0.1.46 Affected: 0.1.47 Affected: 0.1.48 Affected: 0.1.49 Affected: 0.1.50 Affected: 0.1.51 Affected: 0.1.52 Affected: 0.1.53 Affected: 0.1.54 Affected: 0.1.55 Affected: 0.1.56 Affected: 0.1.57 Affected: 0.1.58 Affected: 0.1.59 Affected: 0.1.60 Affected: 0.1.61 Affected: 0.1.62 Affected: 0.1.63 Affected: 0.1.64 Affected: 0.1.65 Affected: 0.1.66 Affected: 0.1.67 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-20T13:26:25.301774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T13:26:31.802Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"tools_webhook"
],
"product": "rowboat",
"vendor": "rowboatlabs",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "affected",
"version": "0.1.1"
},
{
"status": "affected",
"version": "0.1.2"
},
{
"status": "affected",
"version": "0.1.3"
},
{
"status": "affected",
"version": "0.1.4"
},
{
"status": "affected",
"version": "0.1.5"
},
{
"status": "affected",
"version": "0.1.6"
},
{
"status": "affected",
"version": "0.1.7"
},
{
"status": "affected",
"version": "0.1.8"
},
{
"status": "affected",
"version": "0.1.9"
},
{
"status": "affected",
"version": "0.1.10"
},
{
"status": "affected",
"version": "0.1.11"
},
{
"status": "affected",
"version": "0.1.12"
},
{
"status": "affected",
"version": "0.1.13"
},
{
"status": "affected",
"version": "0.1.14"
},
{
"status": "affected",
"version": "0.1.15"
},
{
"status": "affected",
"version": "0.1.16"
},
{
"status": "affected",
"version": "0.1.17"
},
{
"status": "affected",
"version": "0.1.18"
},
{
"status": "affected",
"version": "0.1.19"
},
{
"status": "affected",
"version": "0.1.20"
},
{
"status": "affected",
"version": "0.1.21"
},
{
"status": "affected",
"version": "0.1.22"
},
{
"status": "affected",
"version": "0.1.23"
},
{
"status": "affected",
"version": "0.1.24"
},
{
"status": "affected",
"version": "0.1.25"
},
{
"status": "affected",
"version": "0.1.26"
},
{
"status": "affected",
"version": "0.1.27"
},
{
"status": "affected",
"version": "0.1.28"
},
{
"status": "affected",
"version": "0.1.29"
},
{
"status": "affected",
"version": "0.1.30"
},
{
"status": "affected",
"version": "0.1.31"
},
{
"status": "affected",
"version": "0.1.32"
},
{
"status": "affected",
"version": "0.1.33"
},
{
"status": "affected",
"version": "0.1.34"
},
{
"status": "affected",
"version": "0.1.35"
},
{
"status": "affected",
"version": "0.1.36"
},
{
"status": "affected",
"version": "0.1.37"
},
{
"status": "affected",
"version": "0.1.38"
},
{
"status": "affected",
"version": "0.1.39"
},
{
"status": "affected",
"version": "0.1.40"
},
{
"status": "affected",
"version": "0.1.41"
},
{
"status": "affected",
"version": "0.1.42"
},
{
"status": "affected",
"version": "0.1.43"
},
{
"status": "affected",
"version": "0.1.44"
},
{
"status": "affected",
"version": "0.1.45"
},
{
"status": "affected",
"version": "0.1.46"
},
{
"status": "affected",
"version": "0.1.47"
},
{
"status": "affected",
"version": "0.1.48"
},
{
"status": "affected",
"version": "0.1.49"
},
{
"status": "affected",
"version": "0.1.50"
},
{
"status": "affected",
"version": "0.1.51"
},
{
"status": "affected",
"version": "0.1.52"
},
{
"status": "affected",
"version": "0.1.53"
},
{
"status": "affected",
"version": "0.1.54"
},
{
"status": "affected",
"version": "0.1.55"
},
{
"status": "affected",
"version": "0.1.56"
},
{
"status": "affected",
"version": "0.1.57"
},
{
"status": "affected",
"version": "0.1.58"
},
{
"status": "affected",
"version": "0.1.59"
},
{
"status": "affected",
"version": "0.1.60"
},
{
"status": "affected",
"version": "0.1.61"
},
{
"status": "affected",
"version": "0.1.62"
},
{
"status": "affected",
"version": "0.1.63"
},
{
"status": "affected",
"version": "0.1.64"
},
{
"status": "affected",
"version": "0.1.65"
},
{
"status": "affected",
"version": "0.1.66"
},
{
"status": "affected",
"version": "0.1.67"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "davidgilmore (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool_call of the file apps/experimental/tools_webhook/app.py of the component tools_webhook. Such manipulation of the argument X-Tools-JWE leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T11:45:12.769Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-358269 | rowboatlabs rowboat tools_webhook app.py tool_call improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/358269"
},
{
"name": "VDB-358269 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/358269/cti"
},
{
"name": "Submit #793433 | Rowboat Labs Rowboat 0.1.67 Authentication Bypass Issues",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/793433"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Dave-gilmore-aus/security-advisories/blob/main/rowbat-advisory"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-19T21:25:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "rowboatlabs rowboat tools_webhook app.py tool_call improper authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-6635",
"datePublished": "2026-04-20T11:45:12.769Z",
"dateReserved": "2026-04-19T19:20:06.278Z",
"dateUpdated": "2026-04-20T13:26:31.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7115 (GCVE-0-2025-7115)
Vulnerability from cvelistv5 – Published: 2025-07-07 06:02 – Updated: 2025-07-07 16:47
VLAI
EPSS
VEX
Title
rowboatlabs rowboat Session route.ts PUT missing authentication
Summary
A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/[fileId]/route.ts of the component Session Handler. The manipulation of the argument params leads to missing authentication. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is expected that this issue will be fixed in the near future.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-07 16:35 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.315026 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.315026 | signaturepermissions-required |
| https://vuldb.com/?submit.604899 | third-party-advisory |
| https://github.com/rowboatlabs/rowboat/issues/166 | issue-tracking |
| https://github.com/rowboatlabs/rowboat/issues/166… | issue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rowboatlabs | rowboat |
Affected:
8096eaf63b5a0732edd8f812bee05b78e214ee97
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7115",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-07T16:35:43.534597Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-07T16:47:16.206Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Session Handler"
],
"product": "rowboat",
"vendor": "rowboatlabs",
"versions": [
{
"status": "affected",
"version": "8096eaf63b5a0732edd8f812bee05b78e214ee97"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/[fileId]/route.ts of the component Session Handler. The manipulation of the argument params leads to missing authentication. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is expected that this issue will be fixed in the near future."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in rowboatlabs rowboat bis 8096eaf63b5a0732edd8f812bee05b78e214ee97 ausgemacht. Es geht hierbei um die Funktion PUT der Datei apps/rowboat/app/api/uploads/[fileId]/route.ts der Komponente Session Handler. Durch Manipulieren des Arguments params mit unbekannten Daten kann eine missing authentication-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Dieses Produkt verzichtet auf eine Versionierung und verwendet stattdessen Rolling Releases. Deshalb sind keine Details zu betroffenen oder zu aktualisierende Versionen vorhanden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-07T06:02:07.544Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-315026 | rowboatlabs rowboat Session route.ts PUT missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.315026"
},
{
"name": "VDB-315026 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.315026"
},
{
"name": "Submit #604899 | Rowboat Labs RowBoat git checkout 8096eaf63b5a0732edd8f812bee05b78e214ee97 Unauthorized file upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.604899"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/rowboatlabs/rowboat/issues/166"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/rowboatlabs/rowboat/issues/166#issuecomment-2995195594"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-07-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-07-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-07-06T07:57:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "rowboatlabs rowboat Session route.ts PUT missing authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-7115",
"datePublished": "2025-07-07T06:02:07.544Z",
"dateReserved": "2025-07-06T05:52:09.457Z",
"dateUpdated": "2025-07-07T16:47:16.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}