Server-Side Request Forgery Vulnerability in zhayujie CowAgent Software
CVE-2026-16194

5.3MEDIUM

Key Information:

Vendor

Zhayujie

Status
Cowagent
Vendor
CVE Published:
18 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-16194?

A security flaw has been identified in the zhayujie CowAgent software, specifically affecting the WebFetch.execute function found in the file agent/tools/web_fetch/web_fetch.py. By manipulating the URL argument, an attacker could perform server-side request forgery, potentially allowing unauthorized access to internal services from a remote location. This vulnerability has been publicly disclosed, making it a point of concern for users of the affected version up to 2.1.1. The vendor swiftly responded to the issue, releasing a fixed version (2.1.2) with an associated patch (commit ea47f3097eed4f8295c4cb3d76ecb97e0f43d632). It is highly recommended for all users of CowAgent to upgrade to the latest version to mitigate the risks associated with this vulnerability.

Affected Version(s)

CowAgent 2.1.0

CowAgent 2.1.1

CowAgent 2.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-16194 - Proof of Concept

References

https://vuldb.com/vuln/380009
vdb-entrytechnical-description
https://vuldb.com/vuln/380009/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-16194
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric-x (VulDB User)
VulDB CNA Team
.