CVE-2026-84427: Denial of Service in zhayujie CowAgent

This vulnerability in zhayujie CowAgent (versions 2.1.0 through 2.1.7) involves an unknown function within the Bash Tool component (agent/tools/bash/bash.py) that can be manipulated remotely to cause a denial of service condition. The flaw is identified as CWE-404 (Improper Resource Shutdown or Release). The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability. The vendor was contacted but has not issued any fix or advisory. Public exploit details are available.

Successful exploitation results in denial of service, potentially disrupting the availability of the CowAgent service. The attack can be launched remotely without authentication or user interaction, increasing the risk of exploitation. However, the impact is limited to availability with no reported confidentiality or integrity effects.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates. Until a fix is released, consider limiting network exposure of the affected CowAgent versions and applying compensating controls to reduce risk.