CVE-2026-16194
zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 18, 2026
- Updated
- Jul 20, 2026
- Reserved
- Jul 18, 2026
Description
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
CowAgentzhayujie |
|
References
- VDB-380009 | zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgeryvdb-entrytechnical-description
- VDB-380009 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-16194 | CVE Analysis and Reportthird-party-advisory
- Submit #857620 | zhayujie CowAgent 2.1.1 Server-Side Request Forgery (CWE-918)third-party-advisory
- https://github.com/zhayujie/CowAgent/issues/2889exploitissue-tracking
- https://github.com/zhayujie/CowAgent/pull/2900issue-trackingpatch
- https://github.com/zhayujie/CowAgent/commit/ea47f3097eed4f8295c4cb3d76ecb97e0f43d632patch
- https://github.com/zhayujie/CowAgent/releases/tag/2.1.2patch
- https://github.com/zhayujie/CowAgent/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.