VULNERABILITY INTELLIGENCE
CVE-2026-86122
CVSS score5 MEDIUM
EPSS probability0.37%
CISA KEVNot currently listed
Published2026-09-05
Last modified2026-09-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Description
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.
Weakness classification
- disclosure@vulncheck.com: CWE-918