CowAgent CVE-2026-18992

Exploitation requires the attacker to hold a valid low-privilege authenticated session within CowAgent (PR:L from CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data). The Self-Evolution Review Agent feature must be active and reachable, meaning the agent/evolution/executor.py code path must be enabled in the deployment. No user interaction from a victim is required (UI:N), and no special attack complexity or preconditions beyond authentication are indicated (AC:L/AT:N). Exploitation is limited to the CowAgent application's own trust boundary - no scope change to external systems is indicated. The primary limiting factor is the authentication requirement: environments where all CowAgent users are equally trusted (single-user or fully-trusted internal deployments) face negligible practical risk from authorization bypass.

The CVSS 4.0 score of 5.3 (Medium) reflects bounded but real impact: all three vulnerable-system impact metrics (VC:L/VI:L/VA:L) are low, and no subsequent-system impact is indicated (SC:N/SI:N/SA:N), suggesting the breach is contained within CowAgent's own trust boundary. The attack vector is network (AV:N) with low complexity (AC:L) and no attack requirements (AT:N), meaning exploitation is straightforward once authentication is obtained. PR:L confirms a low-privilege authenticated account is required - this is a meaningful barrier that filters out opportunistic unauthenticated attackers. The exploit-public flag (E:P) elevates practical risk: the GitHub issue thread serves as a public POC, lowering the skill threshold for exploitation. No CISA KEV listing exists, and no EPSS score was provided, leaving widespread exploitation probability unconfirmed. For organizations running CowAgent with multi-tenant or role-differentiated user bases, the risk is moderately elevated due to the authorization bypass nature; single-user or internally-isolated deployments face lower practical exposure. Overall this is a real but targeted-scope issue, not a mass-exploitation candidate.

An attacker with a low-privilege CowAgent account sends a crafted request to the Self-Evolution Review Agent endpoint, manipulating parameters consumed by the _select_tools function in agent/evolution/executor.py to bypass authorization checks. Because the public exploit code from the GitHub issue (https://github.com/zhayujie/CowAgent/issues/2904) demonstrates the technique, a moderately skilled attacker can replicate it, gaining access to tools or agent capabilities gated behind higher-privilege roles. The impact is limited to the CowAgent application boundary (VC:L/VI:L/VA:L), but in multi-tenant deployments this could expose other users' data or allow unauthorized agent actions.