Rowboat Labs Tool Exposed by Improper Authentication Vulnerability

The National Vulnerability Database (NVD) has disclosed CVE-2026-6635, a critical vulnerability affecting rowboatlabs rowboat up to version 0.1.67. The flaw resides within the tool_call function in apps/experimental/tools_webhook/app.py. Exploiting this requires manipulating the X-Tools-JWE argument, leading to improper authentication. Crucially, this vulnerability is remotely exploitable and has seen public disclosure without vendor response.

With a CVSS score of 7.3 (HIGH), this vulnerability presents a significant risk. Attackers can leverage the lack of proper authentication checks to gain unauthorized access or execute actions within the affected component. The NVD notes that the vendor was contacted but failed to respond, leaving users exposed.

Defenders should immediately assess their usage of rowboatlabs rowboat. Patching to a version beyond 0.1.67 is paramount. If patching isn’t feasible, implementing stringent network segmentation and access controls around the tools_webhook component is advised. Auditing logs for suspicious activity related to X-Tools-JWE manipulation should also be a priority.