Description
A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zhayujie | CowAgent | 2.1.0, 2.1.1 | — |
References
- VDB-386368 | zhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization vdb-entry technical-description
- VDB-386368 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-18992 | CVE Analysis and Report third-party-advisory
- Submit #862609 | zhayujie CowAgent 2.1.1 Incorrect Authorization (CWE-863) third-party-advisory
- https://github.com/zhayujie/CowAgent/issues/2904 exploit issue-tracking
- https://github.com/zhayujie/CowAgent/issues/2904#issuecomment-4756833239 issue-tracking
- https://github.com/zhayujie/CowAgent/ product