A security vulnerability (CVE-2026-6635) has been identified in rowboatlabs rowboat up to version 0.1.67. The vulnerability affects the tool_call function in apps/experimental/tools_webhook/app.py within the tools_webhook component. Attackers can manipulate the X-Tools-JWE argument to bypass authentication mechanisms. The attack can be performed remotely and the exploit has been publicly disclosed. The vendor was contacted about this disclosure but has not responded.