ByteOS Network

CVE Vulnerability Details :

CVE-2026-16194

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-18 Jul, 2026 | 21:15

Updated At-18 Jul, 2026 | 21:15

▼CVE Numbering Authority (CNA)

zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected Products

Vendor

zhayujie

Product

CowAgent

CPEs

cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*

Versions

Affected

2.1.0
2.1.1

Unaffected

2.1.2

Problem Types

Type	CWE ID	Description
CWE	CWE-918	Server-Side Request Forgery

Type: CWE

CWE ID: CWE-918

Description: Server-Side Request Forgery

Metrics

Version	Base score	Base severity	Vector
4.0	5.3	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
3.0	6.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2.0	6.5	N/A	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Version: 4.0

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Version: 3.0

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Version: 2.0

Base score: 6.5

Base severity: N/A

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Credits

reporter

Eric-x (VulDB User)

coordinator

VulDB CNA Team

Timeline

Event	Date
Advisory disclosed	2026-07-18 00:00:00
VulDB entry created	2026-07-18 02:00:00
VulDB entry last update	2026-07-18 04:42:54

Event: Advisory disclosed

Date: 2026-07-18 00:00:00

Event: VulDB entry created

Date: 2026-07-18 02:00:00

Event: VulDB entry last update

Date: 2026-07-18 04:42:54

References

Hyperlink	Resource
https://vuldb.com/vuln/380009	vdb-entry technical-description
https://vuldb.com/vuln/380009/cti	signature permissions-required
https://vuldb.com/cve/CVE-2026-16194	third-party-advisory
https://vuldb.com/submit/857620	third-party-advisory
https://github.com/zhayujie/CowAgent/issues/2889	exploit issue-tracking
https://github.com/zhayujie/CowAgent/pull/2900	issue-tracking patch
https://github.com/zhayujie/CowAgent/commit/ea47f3097eed4f8295c4cb3d76ecb97e0f43d632	patch
https://github.com/zhayujie/CowAgent/releases/tag/2.1.2	patch
https://github.com/zhayujie/CowAgent/	product