CVE-2026-6635
Published: 20 April 2026
Summary
CVE-2026-6635 is a medium-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-8 (Identification and Authentication (Non-organizational Users)).
Deeper analysis
CVE-2026-6635 is an improper authentication vulnerability (CWE-287) affecting rowboatlabs rowboat versions up to 0.1.67. The issue resides in the tool_call function within the file apps/experimental/tools_webhook/app.py of the tools_webhook component, where manipulation of the X-Tools-JWE argument bypasses authentication controls. Published on 2026-04-20, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low attack complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized access to the tools_webhook functionality.
Advisories referenced in the GitHub security advisory at https://github.com/Dave-gilmore-aus/security-advisories/blob/main/rowbat-advisory and VulDB entries (https://vuldb.com/submit/793433, https://vuldb.com/vuln/358269, https://vuldb.com/vuln/358269/cti) detail the issue, noting that the exploit has been publicly disclosed and may be used. The vendor was contacted early regarding disclosure but provided no response, and no patches or mitigations are mentioned.
The exploit's public availability increases the risk of active exploitation in affected environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23840
Vulnerability details
A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool_call of the file apps/experimental/tools_webhook/app.py of the component tools_webhook. Such manipulation of the argument X-Tools-JWE leads to improper authentication. The attack may be performed…
more
from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an improper authentication bypass (CWE-287) in a publicly accessible web component (tools_webhook tool_call function) with no auth or interaction required, directly enabling remote exploitation of a public-facing application for unauthorized access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly preventing unauthorized access via the authentication bypass in the tool_call function.
Requires identification and authentication of non-organizational users, countering the remote improper authentication vulnerability exploitable without privileges.
Validates incoming information such as the manipulated X-Tools-JWE header, blocking exploitation attempts on the tools_webhook component.