CVE-2026-86122
Received Received - Intake

Rowboat MCP Server URL Redirection Flaw Enables SSRF

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86122
EUVD
EUVD-2026-71954

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rowboat rowboat 0.9.1
rowboatlabs rowboat 0.9.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86122 is a server-side request forgery (SSRF) vulnerability in Rowboat through version 0.9.1. It allows authenticated users to configure custom MCP server and webhook URLs without proper validation. Attackers can point these URLs at internal services or cloud metadata endpoints to perform SSRF and enumerate internal network topology.

Detection Guidance

Check Rowboat logs for outbound connections to unexpected internal or cloud metadata endpoints. Monitor network traffic for HTTP/HTTPS requests originating from Rowboat to restricted IP ranges or loopback addresses. Review configured custom MCP server and webhook URLs in Rowboat settings for unauthorized or suspicious destinations.

Impact Analysis

This vulnerability enables attackers to direct server requests to internal services, exposing internal network topology and potentially accessing sensitive data. It could also lead to unauthorized actions via manipulated webhook payloads, such as data exfiltration or command execution.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Exposure of internal services may also result in non-compliance with data confidentiality and integrity standards.

Mitigation Strategies

Upgrade Rowboat to a patched version that validates URLs against private, loopback, and link-local IP ranges. Restrict user permissions to prevent unauthorized URL configuration. Implement network-level controls to block outbound requests from Rowboat to internal services or cloud metadata endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart