CVE-2026-5998: Path Traversal in CowAgent

The Path Traversal vulnerability in CowAgent allows an attacker to bypass intended access controls and read arbitrary files on the system. By crafting a malicious filename, an attacker can traverse directories outside the intended scope, potentially accessing configuration files, source code, or other sensitive data. This could lead to information disclosure, privilege escalation, or even remote code execution if the accessed files contain executable code. The published proof-of-concept significantly lowers the barrier to exploitation, increasing the risk of widespread attacks targeting vulnerable deployments.

1. Reserved2026-04-09
2. Published2026-04-10
3. EPSS updated2026-04-17

The primary mitigation for CVE-2026-5998 is to upgrade CowAgent to version 2.0.5, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting network access to the API Memory Content Endpoint or implementing strict input validation on the filename parameter. WAF rules can be configured to block requests containing suspicious path traversal sequences (e.g., '../'). Review and audit file access permissions to ensure least privilege. After upgrading, confirm the fix by attempting a path traversal attack with a known malicious filename and verifying that access is denied.