A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool_call of the file apps/experimental/tools_webhook/…

A security vulnerability (CVE-2026-6635) has been identified in rowboatlabs rowboat up to version 0.1.67. The vulnerability affects the tool_call function in apps/experimental/tools_webhook/app.py within the tools_webhook component. Attackers can manipulate the X-Tools-JWE argument to bypass authentication mechanisms. The attack can be performed remotely and the exploit has been publicly disclosed. The vendor was contacted about this disclosure but has not responded.