CVE-2026-18992: zhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization
A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18992?
The severity of CVE-2026-18992 is rated as medium with a score of 6.3.
How do I fix CVE-2026-18992?
To fix CVE-2026-18992, update zhayujie CowAgent to version 2.1.2 or later, which contains the necessary security patches.
What is the impact of CVE-2026-18992 on zhayujie CowAgent?
CVE-2026-18992 leads to incorrect authorization through the _select_tools function in the Self-Evolution Review Agent, allowing potential unauthorized access.
Who is affected by CVE-2026-18992?
Any user or organization utilizing zhayujie CowAgent versions up to 2.1.1 is affected by CVE-2026-18992.
What is the attack vector for CVE-2026-18992?
The attack vector for CVE-2026-18992 requires local access with limited privileges, making it a low complexity exploit.