Description
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Published: 2026-07-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in CowAgent’s WebFetch.execute function allows an attacker to manipulate the URL argument, causing the server to initiate arbitrary outbound requests. This server‑side request forgery can expose the system to external resources that it is authorized to contact, potentially leaking sensitive data or allowing further compromise. The vulnerability is exploitable from a remote location and has been publicly disclosed.

Affected Systems

The CowAgent codebase released by developer zhayujie is affected. Any installation using version 2.1.1 or earlier is vulnerable. Versions 2.1.2 and later contain a patch that removes the vulnerability.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score is below 1%, suggesting a low likelihood of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the agent’s WebFetch interface and the ability to specify a malicious URL, which are typical conditions for Web application exposures.

Generated by OpenCVE AI on July 30, 2026 at 22:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade CowAgent to version 2.1.2 or later, which contains a fix for the WebFetch SSRF flaw.
  • If an upgrade is not immediately possible, disable the WebFetch functionality or restrict it to only contact trusted internal endpoints until a patch can be applied.
  • Implement network segmentation and strict egress filtering to block unauthorized outbound connections from the server hosting CowAgent until the vulnerability is fully remedied.

Generated by OpenCVE AI on July 30, 2026 at 22:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 18 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery
First Time appeared Zhayujie
Zhayujie cowagent
Weaknesses CWE-918
CPEs cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*
Vendors & Products Zhayujie
Zhayujie cowagent
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zhayujie Cowagent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-20T13:54:55.381Z

Reserved: 2026-07-18T02:37:49.144Z

Link: CVE-2026-16194

cve-icon Vulnrichment

Updated: 2026-07-20T13:54:49.840Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:00:22Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)