This vulnerability affects the _select_tools function in the agent/evolution/executor.py file of the Self-Evolution Review Agent component in zhayujie CowAgent versions 2.1.0 and 2.1.1. An attacker can manipulate this function to bypass authorization controls, potentially gaining unauthorized access or performing unauthorized actions remotely. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. Exploit code is publicly available, increasing the risk of exploitation, but no vendor advisory or patch information is currently available.

The vulnerability allows remote attackers to bypass authorization checks in the affected function, potentially leading to unauthorized actions within the CowAgent software. The impact is limited by the medium severity score and the requirement of low privileges, but the availability of public exploit code increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor for updates from the vendor and consider implementing network-level controls to restrict access to the affected service if possible.