Rowboat
Monthly
Unauthenticated remote denial of service in rowboatlabs rowboat through v0.9.1 allows any network attacker to disrupt the Composio webhook endpoint by sending a crafted HTTP request body that exploits improper resource handling in the Next.js route handler (apps/rowboat/app/api/composio/webhook/route.ts). A proof-of-concept is publicly available on GitHub, removing any skill barrier for exploitation. The vendor resolved the issue in v0.9.2 by deleting the legacy Next.js application entirely rather than patching the underlying flaw, meaning no security control was introduced - only the attack surface was removed.
Improper authentication in rowboatlabs rowboat (versions up to 0.1.67) allows remote unauthenticated attackers to bypass authentication by manipulating the X-Tools-JWE header in the tools_webhook component. The vulnerability enables unauthorized access with low confidentiality, integrity, and availability impact. A public exploit exists (CVSS E:P). The vendor did not respond to early disclosure attempts. EPSS data unavailable; not listed in CISA KEV, suggesting limited widespread exploitation despite public POC.
Unauthenticated remote denial of service in rowboatlabs rowboat through v0.9.1 allows any network attacker to disrupt the Composio webhook endpoint by sending a crafted HTTP request body that exploits improper resource handling in the Next.js route handler (apps/rowboat/app/api/composio/webhook/route.ts). A proof-of-concept is publicly available on GitHub, removing any skill barrier for exploitation. The vendor resolved the issue in v0.9.2 by deleting the legacy Next.js application entirely rather than patching the underlying flaw, meaning no security control was introduced - only the attack surface was removed.
Improper authentication in rowboatlabs rowboat (versions up to 0.1.67) allows remote unauthenticated attackers to bypass authentication by manipulating the X-Tools-JWE header in the tools_webhook component. The vulnerability enables unauthorized access with low confidentiality, integrity, and availability impact. A public exploit exists (CVSS E:P). The vendor did not respond to early disclosure attempts. EPSS data unavailable; not listed in CISA KEV, suggesting limited widespread exploitation despite public POC.