Description

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-05T10:16:43.610Z",
  "pubdate": "2026-09-05T10:16:43.610Z",
  "executiveSummary": "Rowboat versions through 0.9.1 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to insufficient validation of user-supplied URLs.\nThe vulnerability exists within the configuration modules for custom MCP servers and webhook endpoints, where input sanitization is absent.\nAn authenticated attacker can abuse this flaw to force the application to send HTTP requests to arbitrary destinations, including internal network infrastructure and cloud provider metadata services.\nThe impact includes the potential for internal network reconnaissance, unauthorized service interaction, and the potential exposure of sensitive cloud environment credentials.\nExploitation requires authenticated access to the application, allowing an attacker to modify webhook or MCP server destination settings.\nThis represents a significant security risk for organizations hosting Rowboat within trusted network segments or cloud environments with access to metadata endpoints (e.g., 169.254.169.254).",
  "technicalDetails": "The vulnerability arises from the lack of server-side validation or allowlisting for URLs provided during the configuration of custom MCP servers and webhook dispatchers in Rowboat 0.9.1 and earlier.\nWhen a user submits a configuration update, the application fails to perform protocol verification, domain restriction, or network-level filtering on the supplied URL strings.\nThe attack flow initiates when an authenticated user modifies the destination endpoint URL for a webhook or MCP server integration. By injecting an attacker-controlled address, the user influences the server-side logic responsible for initiating outbound HTTP requests.\nBecause the server lacks a mechanism to prevent connections to internal RFC 1918 address spaces, loopback addresses, or the cloud metadata link-local address (169.254.169.254), the application functions as a proxy for the attacker.\nAn attacker can craft a payload targeting specific internal APIs that do not require additional authentication, leveraging the application's service identity or IP-based trust to gain unauthorized access to internal resources.\nFurthermore, by targeting cloud metadata endpoints, an attacker may retrieve identity tokens, instance configurations, or other environment-specific secrets, which can facilitate privilege escalation or lateral movement within the cloud environment.\nThe absence of input validation ensures that the application's underlying HTTP client will process the request as if it originated from a legitimate administrative configuration, bypassing perimeter security controls.\nThe post-exploitation impact includes the successful enumeration of internal network topology, discovery of non-public services, and potential exfiltration of sensitive configuration data or credentials stored within the metadata service.\nThis vulnerability is strictly a configuration-based injection flaw where the application's trust in user-provided destination strings results in uncontrolled outbound traffic, fundamentally violating the principle of least privilege regarding egress network access."
}