Description
A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure.
Published: 2026-10-11
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch ASAP
AI Analysis

Impact

A flaw in CowAgent’s web_console channel allows an attacker to manipulate the session_id parameter in a request, causing the application to crash and become unavailable. The issue is classified as a resource depletion error (CWE‑404) and results in an unavailability condition. The vendor partially mitigated the effect in version 2.1.7 with a 512 MB body size cap, but the fundamental parameter validation problem remains.

Affected Systems

The vulnerability affects the CowAgent product from the vendor zhayujie, specifically all releases up to and including version 2.1.7. The problem originates in the file channel/web/web_channel.py, and the public links show the issue was discovered in the 2.1.7 codebase (commit dec28324).

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, so the likelihood of widespread exploitation is currently unknown. The vulnerability is immediately exploitable from a remote attacker that can reach the Web Console endpoint, and public exploit code has already been released. Because the impact is a denial of service that can affect the availability of the console, swift patching is recommended. The vulnerability is not listed in the CISA KEV catalog, but the public availability of exploit code increases the risk of an attack.

Generated by OpenCVE AI on October 11, 2026 at 15:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest CowAgent patch or upgrade to a version that removes the session_id manipulation flaw.
  • Where an update cannot be applied immediately, limit the number of concurrent Web Console sessions or reduce the resource allocation per session to mitigate crash likelihood.
  • Restrict access to the Web Console using firewall rules or a reverse proxy so that only trusted IP addresses can reach the vulnerable endpoint.

Generated by OpenCVE AI on October 11, 2026 at 15:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure.
Title zhayujie CowAgent Web Console web_channel.py denial of service
First Time appeared Zhayujie
Zhayujie cowagent
Weaknesses CWE-404
CPEs cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*
Vendors & Products Zhayujie
Zhayujie cowagent
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zhayujie Cowagent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-11T13:15:14.693Z

Reserved: 2026-10-10T21:22:10.849Z

Link: CVE-2026-108681

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-11T14:17:03.220

Modified: 2026-10-11T14:17:03.220

Link: CVE-2026-108681

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T15:45:16Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release