High severity · published Apr 12, 2026
CVE-2026-6129
zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
chatgpt-on-wechat CowAgent · zhayujie
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6129
github.com
https://github.com/zhayujie/chatgpt-on-wechat/issues/2741
github.com
https://github.com/zhayujie/chatgpt-on-wechat/issues/2741#issue-4191903266
vuldb.com
https://vuldb.com/submit/795272
vuldb.com
https://vuldb.com/vuln/356992
vuldb.com
https://vuldb.com/vuln/356992/cti
More from chatgpt-on-wechat CowAgent
7.3
CVE-2026-6126
zhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication
6.5
CVE-2026-14714
zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication
6.3
CVE-2026-15628
zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery
5.3
CVE-2026-5998
zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal