CVE-2026-86122

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86122

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86122.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86122

Published

2026-09-05T09:59:10.757Z

Modified

2026-09-06T03:47:20.450158279Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator

Summary

Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

Details

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86122.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/rowboatlabs/rowboat

Affected ranges

Type

GIT

Repo

https://github.com/rowboatlabs/rowboat

Events

Introduced

Last affected

32163579de3cb9cf274e3b09f57d1378f02ee2b7

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.9.1"
        }
    ]
}

Affected versions

v0.*

v0.1.2

v0.1.29

v0.1.47

v0.1.48

v0.1.49

v0.1.50

v0.1.52

v0.1.53

v0.1.54

v0.1.55

v0.1.56

v0.1.57

v0.1.58

v0.1.60

v0.1.63

v0.1.72

v0.1.84

v0.1.85

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.7

v0.3.0

v0.3.1

v0.3.2

v0.3.4

v0.3.5

v0.3.8

v0.3.9

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.6

v0.4.7

v0.4.8

v0.5.0

v0.5.1

v0.5.2

v0.5.4

v0.5.5

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86122.json"