Rowboat MCP/Webhook URL SSRF via Unvalidated Destination Configuration
First seen Sep 6, 2026 · Updated Sep 6, 2026 · CVSS 5
Rowboat versions through 0.9.1 let authenticated users register arbitrary MCP server and webhook URLs without validating the destination, enabling server-side request forgery. An attacker can abuse this to reach internal-only services or cloud instance metadata endpoints, potentially exposing credentials or internal network topology. This is a classic insecure agent-tool-configuration flaw rather than a novel agentic attack technique.
Technical Analysis
The vulnerability lies in Rowboat's configuration layer for MCP servers and webhooks, where user-supplied URLs are accepted and later dereferenced by the backend without allowlisting, DNS/IP resolution checks, or blocking of link-local and internal ranges. An authenticated attacker sets a malicious MCP endpoint or webhook target pointing at an internal service (e.g., 169.254.169.254 for cloud metadata, or private RFC1918 addresses) and the Rowboat server itself makes the outbound request, effectively acting as an SSRF proxy. This crosses the tool boundary because the agent's MCP client trusts the configured server URL as a legitimate tool endpoint, giving the attacker read access to internal APIs, cloud IAM credentials via metadata services, or the ability to port-scan the internal network. The impact is amplified in agent architectures because MCP server registration is often treated as a trusted configuration action rather than a network-facing attack surface.
Affected Systems
Rowboat; protocols: MCP
Detection Signatures
- Outbound requests from Rowboat backend to RFC1918/link-local addresses (169.254.169.254, 10.x.x.x, 192.168.x.x, 172.16-31.x.x)
- MCP server/webhook URL fields containing internal hostnames, IP literals, or metadata service paths
- Unexpected spikes in failed/successful connections to internal-only ports from the Rowboat host
- Webhook or MCP config changes followed immediately by outbound traffic to non-public IP ranges
- Log entries showing MCP server registration events with non-allowlisted domains
Remediation Steps
- 1
Upgrade Rowboat
Apply the vendor patch or upgrade beyond 0.9.1 once available; track the CVE for a fixed release.
- 2
Allowlist MCP/webhook destinations
Restrict configurable MCP server and webhook URLs to a vetted allowlist of domains/IPs; reject private, loopback, and link-local ranges.
- 3
Block metadata endpoint access
Use network-level controls (e.g., IMDSv2 enforcement, egress firewall rules) to prevent application servers from reaching cloud metadata IPs.
- 4
Validate and resolve URLs server-side
Resolve hostnames server-side and block DNS rebinding to internal IPs before making the outbound MCP/webhook request.
- 5
Restrict privilege of the configuring role
Limit which authenticated user roles can add or modify MCP server/webhook destinations, and audit these changes.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.