PT-2026-33757 · Rowboatlabs · Rowboat

Davidgilmore · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6635

NVD

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool call of the file apps/experimental/tools webhook/app.py of the component tools webhook. Such manipulation of the argument X-Tools-JWE leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-6635

Affected Products

Rowboat

References · 5

• 🔥 https://github.com/Dave-gilmore-aus/security-advisories/blob/main/rowbat-advisory · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6635 · Security Note
• https://vuldb.com/vuln/358269/cti · Note
• https://vuldb.com/submit/793433 · Note
• https://vuldb.com/vuln/358269 · Note