Server-Side Request Forgery in Rowboat Affects Configurable MCP and Webhook URLs

CVE-2026-86122

What is CVE-2026-86122?

The Rowboat application, specifically versions up to 0.9.1, contains a critical vulnerability that fails to properly validate custom MCP server and webhook URLs. This oversight allows authenticated users to manipulate these URLs to point towards arbitrary destinations, including internal services and cloud metadata endpoints. Such exploitation can lead to server-side request forgery attacks, enabling attackers to enumerate and extract sensitive information from the internal network. This vulnerability poses a significant risk as it could expose network topology and sensitive data, highlighting the urgent need for remediation measures.

References