CowAgent CVE-2026-84425

The attacker must have low-privilege authenticated access (PR:L per CVSS 4.0) to the CowAgent instance - specifically the ability to submit agent tasks that invoke the BrowserTool. The BrowserTool component must be enabled and active in the CowAgent configuration; deployments that do not use or expose the browser automation capability are not affected. The vulnerability is triggered by a specific manipulation of the browser evaluate/wait logic in browser_tool.py, as detailed in the public PoC titled 'CowAgent_Browser_Evaluate_Wait_DoS_Report'. Exploitation impact is strictly limited to availability (VA:L); there is no code execution, data exfiltration, or integrity compromise. Limiting factors: requires at least low-privilege access to the agent interface; impact is partial service disruption, not full system compromise; niche deployment footprint reduces mass-exploitation likelihood.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P) reflects a moderate-severity DoS with a public exploit. The PR:L requirement constrains exploitation to users who have authenticated access to the CowAgent instance, meaningfully limiting the attack surface compared to an unauthenticated flaw. Availability impact is rated low (VA:L), indicating partial or intermittent service disruption rather than a full crash. No EPSS data was supplied; given CowAgent's niche AI-agent-framework footprint, opportunistic mass exploitation is unlikely. No CISA KEV listing - this is not known to be actively exploited at scale. Real-world priority is low for most organizations, but operators running CowAgent with untrusted or semi-trusted user access should treat the absence of a vendor patch as a notable gap.

An authenticated user with low-privilege access to a CowAgent deployment submits a crafted task that invokes the BrowserTool with input specifically designed to cause an evaluate() or waitFor*() call to hang indefinitely. The browser subprocess never releases its resources, progressively exhausting system memory or thread pool slots until the CowAgent service becomes unresponsive to other users. A public proof-of-concept on GitHub documents the exact trigger, lowering the bar for exploitation.