CVE-2026-16194

MEDIUM 6.3

zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CWE	CWE-918
Vendor	zhayujie
Product	cowagent
Published	Jul 18, 2026

Stay Ahead of the Next One

Get instant alerts for zhayujie cowagent

Be the first to know when new medium vulnerabilities affecting zhayujie cowagent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

zhayujie / CowAgent

2.1.0 2.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/380009 vuldb.com: https://vuldb.com/vuln/380009/cti vuldb.com: https://vuldb.com/cve/CVE-2026-16194 vuldb.com: https://vuldb.com/submit/857620 github.com: https://github.com/zhayujie/CowAgent/issues/2889 github.com: https://github.com/zhayujie/CowAgent/pull/2900 github.com: https://github.com/zhayujie/CowAgent/commit/ea47f3097eed4f8295c4cb3d76ecb97e0f43d632 github.com: https://github.com/zhayujie/CowAgent/releases/tag/2.1.2 github.com: https://github.com/zhayujie/CowAgent/

Credits

🔍 Eric-x (VulDB User) VulDB CNA Team