Rowboat bug lets a user's MCP URL reach cloud metadata

Rowboat through version 0.9.1 doesn't check where a custom MCP server or webhook URL actually points. An authenticated user can set that URL to an internal service or a cloud metadata endpoint, and the server fetches it anyway. That's enough to enumerate a network's internal topology from inside the perimeter, using credentials that were only supposed to configure an integration.

NVD's listing went up September 5 as CVE-2026-86122. It's the third entry in this NVD window with the same root cause: a user-supplied MCP server_url gets fetched with no destination check. OGX and OWL both have open CVEs for the identical pattern.

Three unrelated codebases making the same mistake isn't bad luck. It's a gap in how products added MCP support. A server_url field takes user input and the server fetches it, the same shape as a webhook URL, and a webhook URL needs a destination guard for exactly this reason. Whoever built these three integrations didn't carry that guard over.

The fix NVD's advisory points at is validation on the server, since the client is what you don't trust in this threat model. If you shipped a product that lets users point it at their own MCP server, check for the same gap before it becomes your own CVE entry.

What NVD's entry doesn't say is whether Rowboat has patched it yet or which version fixes it. Anyone running Rowboat should look for an update before treating this as closed.