rowboat vulnerabilities

CVEs whose affected-version data names the rowboat package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-86122Medium· 5.0

2w ago

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform ser…

▾ Sunlitrowboatlabs · rowboatEPSS 0.23%via NVD