CVE-2026-15628: chatgpt-on-wechat CowAgent SSRF Vulnerability

CVE-2026-15628 Overview

CVE-2026-15628 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting zhayujie chatgpt-on-wechat CowAgent versions up to 2.1.1. The flaw resides in the Vision._download_to_data_url function within agent/tools/vision/vision.py, part of the Vision Tool component. Attackers can manipulate the image argument to coerce the server into issuing arbitrary outbound HTTP requests. The vulnerability is exploitable remotely and requires low privileges. Public exploit code has been released, increasing the risk of opportunistic abuse. Upgrading to version 2.1.2 addresses the issue via patch commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264.

Critical Impact
Remote attackers with low privileges can force the CowAgent Vision Tool to fetch attacker-controlled URLs, potentially exposing internal network resources, cloud metadata endpoints, and non-public services.

Affected Products

zhayujie chatgpt-on-wechat CowAgent versions up to and including 2.1.1
Vision Tool component (agent/tools/vision/vision.py)
Deployments exposing the Vision._download_to_data_url function to untrusted input

Discovery Timeline

2026-07-14 - CVE-2026-15628 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15628

Vulnerability Analysis

The Vision Tool in CowAgent accepts an image argument that is passed directly to a URL download routine without validating the destination host. The _download_to_data_url method issues an HTTP request to the supplied URL and returns the fetched content encoded as a data URL. Because no allow-list or network boundary checks are enforced, attackers can substitute URLs pointing to internal IP ranges, loopback interfaces, or cloud instance metadata services. This behavior falls under CWE-918 (Server-Side Request Forgery). Exploitation requires only low-privileged authenticated access and no user interaction. The public availability of exploit details raises the likelihood of automated scanning against exposed CowAgent instances.

Root Cause

The root cause is missing validation of the URL scheme, hostname, and resolved IP address before performing the outbound request. User-supplied input flows directly into a requests-based fetch, allowing arbitrary hosts—including private RFC1918 ranges and link-local addresses like 169.254.169.254—to be contacted by the server.

Attack Vector

An attacker with low-privileged access to the CowAgent API submits a crafted image parameter referencing an internal URL. The server dereferences the URL and returns response content or observable side effects to the attacker. This enables reconnaissance of internal services, retrieval of cloud metadata credentials, and interaction with unauthenticated internal APIs.

python

# Patch excerpt from agent/tools/vision/vision.py (v2.1.2)
# Adds imports required for URL/host validation to block SSRF
import base64
import ipaddress
import os
import socket
import subprocess
import tempfile
from dataclasses import dataclass, field
from typing import Any, Dict, List, Optional
from urllib.parse import urlparse

import requests
# Source: https://github.com/zhayujie/CowAgent/commit/e85290cddcbb5ffc9c235927f4c92e5b4c3ec264

Detection Methods for CVE-2026-15628

Indicators of Compromise

Outbound HTTP requests from CowAgent hosts to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses
Requests from CowAgent processes to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
Anomalous image parameter values in Vision Tool API calls containing internal hostnames, IPs, or non-HTTP schemes like file:// or gopher://

Detection Strategies

Inspect application logs for calls to Vision._download_to_data_url with URLs resolving to non-public destinations
Deploy egress network monitoring to flag CowAgent-originated connections to unexpected internal targets
Correlate API access logs with DNS resolution telemetry to identify SSRF probing patterns

Monitoring Recommendations

Enable request-level logging on the Vision Tool endpoint, capturing full argument payloads
Monitor for spikes in Vision Tool invocations from single low-privilege accounts
Alert on any CowAgent connection attempts to cloud metadata IP addresses or internal management interfaces

How to Mitigate CVE-2026-15628

Immediate Actions Required

Upgrade CowAgent to version 2.1.2 or later, which contains the fix in commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264
Restrict Vision Tool access to trusted authenticated users only and audit existing user privileges
Place CowAgent behind an egress proxy that blocks requests to private IP ranges and cloud metadata endpoints

Patch Information

The fix is delivered in GitHub Release 2.1.2 via patch commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The patch introduces ipaddress, socket, and urlparse imports to enable URL scheme validation and resolved-IP checks before performing outbound HTTP requests. Additional context is available in GitHub Issue #2878 and Pull Request #2886.

Workarounds

Disable the Vision Tool component entirely if it is not required for production workflows
Deploy a network policy that denies outbound traffic from CowAgent to RFC1918 ranges, 127.0.0.0/8, and 169.254.0.0/16
Add a reverse proxy in front of CowAgent that validates and rewrites the image parameter against an allow-list of trusted image hosts

bash

# Example egress restriction using iptables to block SSRF to metadata and internal ranges
iptables -A OUTPUT -m owner --uid-owner cowagent -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cowagent -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cowagent -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cowagent -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cowagent -d 192.168.0.0/16 -j REJECT