CVE-2026-6635

BRIEFING NOTE: CVE-2026-6635 Rowboat Labs' rowboat tool up to version 0.1.67 contains an authentication bypass vulnerability in the tools_webhook component. The flaw exists in the tool_call function of apps/experimental/tools_webhook/app.py, where improper validation of the X-Tools-JWE argument allows attackers to circumvent authentication controls. The vulnerability carries a HIGH severity rating of 7.3 CVSS with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The impact is moderate, affecting confidentiality, integrity, and availability with consequences limited to the vulnerable application scope. This positions it as a significant remote exploitation risk that could lead to unauthorized access and data manipulation. The exploit has been publicly disclosed, and while there is no current evidence of active exploitation in the wild, the vendor has not responded to early disclosure notifications. The FAUCET risk score of 37.0 and presence on the active Hot List suggest ongoing community attention. Organizations running affected versions should prioritize patching beyond version 0.1.67 and implement access controls to restrict unauthenticated tool_webhook requests.