CowAgent vulnerabilities
5 known CVE vulnerabilities in CowAgent, translated and rated.
- CVE-2026-18992Medium
A vulnerability was detected in zhayujie CowAgent up to 2.1.1. It affects the function _select_tools in the file agent/evolution/executor.py of the Self-Evolution Review Agent component. Manipulation leads to incorrect authorization. The attack can be performed remotely, and the exploit is public.
- CVE-2026-16194Medium
A server-side request forgery (SSRF) vulnerability was found in zhayujie CowAgent up to version 2.1.1 in the WebFetch.execute function of agent/tools/web_fetch/web_fetch.py. The attack can be performed remotely by manipulating the url argument, and the exploit has been publicly disclosed.
- CVE-2026-15332Medium
A security flaw in zhayujie CowAgent up to 2.1.0 exists in channel/channel.py of the Message Endpoint component. Missing authorization in an unknown function allows remote unauthenticated attacks. The exploit is public and may be used in attacks.
- CVE-2026-15331Medium
A path traversal vulnerability was found in zhayujie CowAgent up to version 2.1.0 in the _add_url/_add_package function of agent/skills/service.py. Manipulation of the Name argument allows remote attack.
- CVE-2026-15329Medium
A vulnerability in zhayujie CowAgent up to version 2.1.0 affects the BrowserTool._do_navigate function in agent/tools/browser/browser_tool.py. Input manipulation leads to information disclosure. The attack can be performed remotely and the exploit has been made public.