CVE-2026-108681: zhayujie CowAgent denial of service in Web Console

CVE-2026-108681 · Severity: medium · CVSS 4.3 · Published 2026-10-11

CowAgent is a web-based AI agent framework that provides a console interface for managing agent workflows. An authenticated attacker with access to the Web Console can trigger a denial of service by sending malicious requests with oversized message bodies or numerous unique session IDs, causing excessive memory consumption and thread creation that crashes the service.

Technologies: Zhayujie CowAgent. Vendors: Zhayujie.

Quick answers

Is CVE-2026-108681 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-108681 being exploited in the wild.
How severe is CVE-2026-108681?
Medium severity, with a CVSS score of 4.3, published 11 October 2026.
Which products and versions are affected?
Zhayujie CowAgent up to 2.1.7.
Is there a fix for CVE-2026-108681?
Yes: fixed in 2.1.8 or later (version 2.1.7 only partially mitigates with a 512MB body cap). Until then: Ensure web_password is configured to enable authentication, restrict web_host binding to localhost (127.0.0.1) rather than 0.0.0.0, and implement network-level access controls to limit exposure of the Web Console to trusted networks only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108681 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-108681?
Check whether you run Zhayujie CowAgent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.1.8 or later (version 2.1.7 only partially mitigates with a 512MB body cap)

Ensure web_password is configured to enable authentication, restrict web_host binding to localhost (127.0.0.1) rather than 0.0.0.0, and implement network-level access controls to limit exposure of the Web Console to trusted networks only.

Technical details

The Web Console /message endpoint reads complete HTTP request bodies into memory via web.data() before enforcing any size limits, then parses JSON and allocates unbounded per-request state (request maps, SSE streams, session queues, threads) without rate limiting. An attacker can submit messages with large bodies, long message fields, or large attachment arrays to cause memory exhaustion and unbounded thread creation; authentication is disabled by default when no web_password is configured, and public deployment is supported via 0.0.0.0 binding.

Affected products

  • zhayujie CowAgent up to 2.1.7

Timeline

  • 2026-10-11: disclosed
  • other: Exploit released to the public

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.