EUVD-2026-45404
GHSA-wcfc-xp4r-c7rv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring low-privilege authentication; low C/I/A reflects indirect access to internal resources with no direct code execution or scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct the server to issue arbitrary HTTP requests by supplying a crafted URL to the WebFetch.execute function, enabling internal network reconnaissance and cloud metadata credential theft. The WebFetch tool lacked any IP-range validation, leaving loopback, RFC1918, link-local, and cloud metadata endpoints (e.g., 169.254.169.254) fully reachable from the server. A public proof-of-concept exists (GitHub issue #2889); the CVSS 4.0 threat metric E:P confirms exploit code availability, though no CISA KEV listing indicates confirmed widespread active exploitation.
Technical ContextAI
CowAgent is an LLM-powered agentic AI framework (CPE: cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*) that exposes callable tools - including WebFetch and Vision - to an underlying language model. CWE-918 (Server-Side Request Forgery) arises because agent/tools/web_fetch/web_fetch.py accepted the url argument in WebFetch.execute without resolving or validating the destination IP against non-public ranges prior to issuing the HTTP request. Notably, the Vision tool already contained a partial SSRF guard, but it was not applied to WebFetch and also lacked checks for multicast and unspecified address classes. The fix (PR #2900, commit ea47f3097eed4f8295c4cb3d76ecb97e0f43d632) introduces a shared url_safety.py module that resolves DNS, rejects non-HTTP(S) schemes, and blocks private, loopback, link-local, reserved, multicast, and unspecified IPs for both IPv4 and IPv6. It also disables automatic redirect following and re-validates each hop target, preventing a public URL from bouncing via 3xx redirects into an internal address.
RemediationAI
Upgrade to CowAgent version 2.1.2 immediately; this is the vendor-confirmed fix, released at https://github.com/zhayujie/CowAgent/releases/tag/2.1.2 via patch commit ea47f3097eed4f8295c4cb3d76ecb97e0f43d632 (PR #2900). If immediate upgrade is not possible, apply network-layer egress filtering on the host running CowAgent to block outbound connections to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), link-local (169.254.0.0/16, including the cloud IMDS endpoint), and IPv6 private/loopback ranges - this compensating control prevents the most severe exploitation paths (cloud credential theft, internal pivoting) at the cost of restricting legitimate intranet use cases. Alternatively, disable the WebFetch tool in the agent configuration entirely if external URL fetching is not required, eliminating the attack surface with no side effects on non-web workflows.
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade a
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated r
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to
Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today