CVE-2026-16194: zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/webfetch/webfetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zhayujie CowAgentto a version that resolves this vulnerability.Fixed in 2.1.2Patch ea47f3097eed4f8295c4cb3d76ecb97e0f43d632
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16194?
The severity of CVE-2026-16194 is medium with a score of 6.3.
What does CVE-2026-16194 affect?
CVE-2026-16194 affects the zhayujie CowAgent software, specifically the WebFetch.execute function in web_fetch.py.
How does CVE-2026-16194 expose systems to risk?
CVE-2026-16194 exposes systems to risk through server-side request forgery, which can be exploited remotely.
How do I fix CVE-2026-16194?
To fix CVE-2026-16194, update the zhayujie CowAgent to a version beyond 2.1.1 that addresses the vulnerability.
What type of vulnerability is CVE-2026-16194 classified as?
CVE-2026-16194 is classified as a server-side request forgery (SSRF) vulnerability.