Executive brief
Rowboat is an AI coworker application that allows users to configure custom integrations via MCP server and webhook URLs. The application fails to validate these URLs, enabling authenticated users to redirect requests to internal services and cloud metadata endpoints, potentially exposing sensitive infrastructure information and enabling reconnaissance of internal networks.
Technical details
Rowboat fails to properly validate custom MCP (Model Context Protocol) server and webhook URLs, allowing authenticated users to specify arbitrary destinations. The vulnerability lies in the agent-tools component which processes these URL configurations without enforcing URL validation or blocklisting. An attacker with authentication credentials can configure these URLs to point at internal services (e.g., localhost endpoints, private cloud APIs) or cloud metadata endpoints (e.g., AWS IMDSv1), enabling server-side request forgery (SSRF) attacks. This allows reconnaissance of internal network topology and potential exposure of sensitive metadata. Authentication is required, limiting the attack surface to authenticated users.
Affected products
- Rowboat Labs Rowboat through 0.9.1
Timeline
- 2026-09-05: disclosed