Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N N L 5.5 .0070 51.6 —
AFFECTED Product Versions Fixed rowboat 0.9.0 – 0.9.2
TIMELINE Sep 2 Reserved by VulDB Sep 2 Published (CNA: VulDB) Sep 3 EXPLOIT PUBLISHED — CVE-2026-84856 (rowboatlabs rowboat). Public exploit reference added.
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.
| Date | Event | Detail |
|---|---|---|
| September 2, 2026 | Reserved | Reserved by VulDB |
| September 2, 2026 | Published | Published (CNA: VulDB) |
| September 3, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-84856 (rowboatlabs rowboat). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| rowboatlabs | rowboat | — | 0.9.0 | 0.9.2 |
Authoritative record: CVE-2026-84856 at cve.org
Vendors: rowboatlabs
Weaknesses: CWE-404
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-84856 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
