Is there a public PoC exploit available for CVE-2026-15628?

Yes, a public proof-of-concept exploit is available for CVE-2026-15628. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-15628?

Yes, a patch is available for CVE-2026-15628. Update the affected software to the latest version immediately.

CowAgent CVE-2026-15628

Q: What is the CVSS score of CVE-2026-15628?

CVE-2026-15628 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43617 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-14 VulDB

GHSA-76cc-739m-wwpv

SSRF Chatgpt On Wechat Cowagent Zhayujie

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible SSRF requiring low-privilege auth (PR:L per CVSS 4.0); scope unchanged; limited C/I/A consistent with SSRF without confirmed data exfiltration primitives.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 14, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

Jul 14, 2026 - 04:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

Jul 14, 2026 - 03:46 vuln.today

Analysis Generated

Jul 14, 2026 - 03:46 vuln.today

CVE Published

Jul 14, 2026 - 03:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function Vision._download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Performing a manipulation of the argument image results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.1.2 is capable of addressing this issue. The patch is named e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The affected component should be upgraded.

AnalysisAI

Server-side request forgery in zhayujie CowAgent's Vision Tool allows authenticated remote attackers to make the server issue arbitrary HTTP requests to internal network resources. The vulnerability exists in the Vision._download_to_data_url / _build_image_content function in agent/tools/vision/vision.py, where the image argument is passed to an HTTP fetch without URL validation, enabling access to private RFC1918 addresses, loopback interfaces, and other non-public infrastructure. A publicly available proof-of-concept exploit exists (GitHub issue #2878), and a vendor-released patch (version 2.1.2) is available.

Technical ContextAI

CowAgent is a WeChat-integrated AI agent framework (CPE: cpe:2.3:a:zhayujie:chatgpt-on-wechat_cowagent:*:*:*:*:*:*:*:*) that exposes a Vision Tool for processing images. The affected function _build_image_content in agent/tools/vision/vision.py accepted a caller-supplied URL string and issued an outbound HTTP request without validating the destination against allowlists or blocking private address ranges, fulfilling CWE-918 (Server-Side Request Forgery). The patch (commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264) adds a _validate_url_safe static method that enforces http/https scheme, resolves the hostname via socket.getaddrinfo, and rejects any resolved IP that is private, loopback, link-local, or reserved using Python's ipaddress module. The same PR also addresses a path traversal weakness in agent/skills/service.py via a new _safe_skill_dir helper using os.path.realpath boundary checks.

RemediationAI

The primary fix is upgrading to CowAgent version 2.1.2, which is confirmed available via the vendor GitHub release at https://github.com/zhayujie/CowAgent/releases/tag/2.1.2 (patch commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264, PR https://github.com/zhayujie/CowAgent/pull/2886). If immediate upgrade is not possible, operators should restrict the network egress of the CowAgent host using firewall rules to block outbound connections to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) addresses - this directly limits SSRF blast radius but does not eliminate the vulnerability itself. For cloud deployments, enforcing IMDSv2 on AWS EC2 (or equivalent on GCP/Azure) removes the cloud metadata pivoting risk. Restricting access to the Vision Tool feature or requiring stricter authentication scopes for image-processing endpoints are additional compensating controls worth evaluating, noting these may break legitimate functionality.