Medium severity · published Jul 10, 2026
CVE-2026-15332
zhayujie CowAgent Message Endpoint channel.py authorization
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unknown function of the file channel/channel.py of the component Message Endpoint. The manipulation results in missing authorization. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CowAgent · zhayujie
2.0; 2.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15332
github.com
https://github.com/zhayujie/CowAgent/
github.com
https://github.com/zhayujie/CowAgent/issues/2874
vuldb.com
https://vuldb.com/cve/CVE-2026-15332
vuldb.com
https://vuldb.com/submit/853105
vuldb.com
https://vuldb.com/vuln/377275
vuldb.com
https://vuldb.com/vuln/377275/cti
More from CowAgent
7.3
CVE-2026-15330
zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery
6.3
CVE-2026-18992
zhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization
6.3
CVE-2026-16194
zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery
5.4
CVE-2026-108682
zhayujie CowAgent Web Console upload read denial of service
5.4
CVE-2026-15331
zhayujie CowAgent Skill Installation service.py _add_package path traversal