CVE-2026-15330: CowAgent Vision Tool SSRF Vulnerability

CVE-2026-15330 Overview

CVE-2026-15330 is a Server-Side Request Forgery (SSRF) vulnerability in zhayujie CowAgent through version 2.1.1. The flaw resides in the _build_image_content and _download_to_data_url functions within agent/tools/vision/vision.py, which make up the Vision Tool component. An unauthenticated attacker can manipulate the image argument to coerce the server into issuing arbitrary outbound HTTP requests. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. The issue is tracked under CWE-918: Server-Side Request Forgery and is addressed in CowAgent 2.1.2 via commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264.

Critical Impact
A remote, unauthenticated attacker can abuse the Vision Tool image fetcher to reach internal services, cloud metadata endpoints, and other network resources reachable from the CowAgent host.

Affected Products

zhayujie CowAgent versions up to and including 2.1.1
Component: Vision Tool (agent/tools/vision/vision.py)
Fixed release: CowAgent 2.1.2

Discovery Timeline

2026-07-10 - CVE-2026-15330 published to NVD
2026-07-10 - Last updated in NVD database
Patch commit - e85290cddcbb5ffc9c235927f4c92e5b4c3ec264 published in GitHub Release v2.1.2

Technical Details for CVE-2026-15330

Vulnerability Analysis

CowAgent's Vision Tool accepts an image argument that can be either a local path or a remote URL. The _build_image_content helper delegates remote fetches to _download_to_data_url, which issues an outbound HTTP request using requests without validating the URL scheme, host, or resolved IP address. An attacker supplying a URL that points to an internal endpoint causes the CowAgent process to fetch that resource on their behalf. Because the tool operates within the agent runtime, response data may be reflected back into agent context or logs, enabling information disclosure in addition to blind SSRF.

Root Cause

The root cause is missing URL validation prior to network I/O. The pre-patch code imported only requests and had no logic to parse the URL, resolve the hostname, or reject private, loopback, link-local, or reserved address ranges. Any user-controlled image value was passed directly to the HTTP client.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. An attacker submits a crafted image reference — for example, http://169.254.169.254/latest/meta-data/ on cloud hosts or http://127.0.0.1:<port>/ for local services — through any interface that reaches the Vision Tool. CowAgent then performs the request server-side, exposing internal HTTP endpoints, cloud instance metadata, and other resources otherwise unreachable from the internet.

python

# Patch excerpt: agent/tools/vision/vision.py (v2.1.2)
# fix(security): SSRF protection for vision tool

import base64
import ipaddress
import os
import socket
import subprocess
import tempfile
from dataclasses import dataclass, field
from typing import Any, Dict, List, Optional
from urllib.parse import urlparse

import requests

Source: GitHub Commit e85290c

The patch introduces ipaddress, socket, and urlparse so the fetcher can parse the target URL, resolve its hostname, and reject non-public address ranges before any HTTP request is issued.

Detection Methods for CVE-2026-15330

Indicators of Compromise

Outbound HTTP requests from the CowAgent process to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) ranges.
Vision Tool invocations with image arguments referencing cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Requests to non-HTTP(S) schemes such as file://, gopher://, or ftp:// in Vision Tool logs.

Detection Strategies

Monitor CowAgent application logs for Vision Tool calls where the image parameter contains internal hostnames, private IPs, or unusual URL schemes.
Correlate egress firewall telemetry with the CowAgent host to identify unexpected connections to internal services or metadata services.
Add DNS logging on the CowAgent host to surface lookups for internal-only domains initiated by the agent process.

Monitoring Recommendations

Alert on any successful HTTP response from the CowAgent host to cloud metadata IPs.
Baseline normal Vision Tool destinations and flag deviations, particularly private ranges and localhost ports.
Enable request-level logging for the _download_to_data_url code path, including the resolved IP address and response size.

How to Mitigate CVE-2026-15330

Immediate Actions Required

Upgrade CowAgent to version 2.1.2 or later, which contains commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264.
Restrict outbound network access from the CowAgent host to only the domains required for legitimate vision workloads.
Block access to cloud instance metadata services (for example, enforce IMDSv2 on AWS or apply metadata firewall rules on GCP/Azure) for the CowAgent host.

Patch Information

The fix is available in CowAgent 2.1.2. Commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264 adds URL parsing, hostname resolution via socket, and ipaddress checks in agent/tools/vision/vision.py, and adds a _safe_skill_dir path-traversal guard in agent/skills/service.py. See GitHub Pull Request #2886 and GitHub Issue #2872 for context.

Workarounds

If patching is not immediately possible, disable the Vision Tool or block the image URL input path at the application layer.
Deploy an egress proxy that only allows HTTPS traffic to an allowlist of external image hosts.
Run CowAgent in a network segment with no route to internal services or cloud metadata endpoints.

bash

# Example egress restriction using iptables to block metadata and RFC1918 destinations
# for the user running CowAgent (replace 'cowagent' with the actual service account)

sudo iptables -A OUTPUT -m owner --uid-owner cowagent -d 169.254.169.254 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner cowagent -d 127.0.0.0/8 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner cowagent -d 10.0.0.0/8 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner cowagent -d 172.16.0.0/12 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner cowagent -d 192.168.0.0/16 -j REJECT