High severity · published Apr 12, 2026
CVE-2026-6126
zhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.0.4. The affected element is an unknown function of the component Administrative HTTP Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
chatgpt-on-wechat CowAgent · zhayujie
2.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6126
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6126
github.com
https://github.com/zhayujie/chatgpt-on-wechat/issues/2733
github.com
https://github.com/zhayujie/chatgpt-on-wechat/issues/2733#issue-4177804035
vuldb.com
https://vuldb.com/submit/793554
vuldb.com
https://vuldb.com/submit/795335
vuldb.com
https://vuldb.com/vuln/356990
vuldb.com
https://vuldb.com/vuln/356990/cti
More from chatgpt-on-wechat CowAgent
7.3
CVE-2026-6129
zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication
6.5
CVE-2026-14714
zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication
6.3
CVE-2026-15628
zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery
5.3
CVE-2026-5998
zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal