| Título | zhayujie CowAgent 2.1.1 Incorrect Authorization (CWE-863) |
|---|
| Descripción | # Technical Details
An Incorrect Authorization vulnerability exists in the Self-Evolution background review pipeline of CowAgent. The `agent/evolution/executor.py` module creates a restricted review agent with a filtered tool subset via `_select_tools()` and workspace guards via `_guard_tools()`. However, during execution in `agent/protocol/agent_stream.py`, the runtime unconditionally calls `ToolManager().sync_mcp_into_agent(self)` before generating tool definitions for the current turn. The sync routine in `agent/tools/tool_manager.py` appends all loaded MCP tools into the live agent without checking whether the target agent is the restricted Self-Evolution review agent.
# Vulnerable Code
File: agent/evolution/executor.py (lines 409-430)
Method: run_evolution_for_session()
Why: The review agent is correctly built with restricted tools, but the boundary is broken later at runtime.
File: agent/protocol/agent_stream.py (lines 730-737)
Method: _call_llm_stream()
Why: Unconditionally calls sync_mcp_into_agent() without checking if the agent is a restricted review agent.
File: agent/tools/tool_manager.py (lines 509-545)
Method: sync_mcp_into_agent()
Why: Appends all MCP tools without reapplying the restricted Self-Evolution tool policy.
# Reproduction
1. Deploy CowAgent with self_evolution_enabled and a workspace mcp.json containing MCP tools.
2. Send a normal chat message via POST /message.
3. Wait for the idle Self-Evolution worker to launch the restricted review agent.
4. Observe that the review agent calls forbidden MCP tools and writes canary files.
5. Confirm the evidence log shows "[DEFECT CONFIRMED]".
# Impact
- Policy-boundary bypass in autonomous background agent path.
- Write-capable MCP tools can modify workspace files the review agent was not supposed to touch.
- Command-capable or side-effect-capable MCP tools can trigger external actions during unattended background review.
- Knowledge, memory, output, or other automation artifacts can be modified by a review agent intended to have reduced capabilities. |
|---|
| Fuente | ⚠️ https://github.com/zhayujie/CowAgent/issues/2904 |
|---|
| Usuario | ChenMarry (UID 99089) |
|---|
| Sumisión | 2026-06-18 09:29 (hace 2 meses) |
|---|
| Moderación | 2026-08-05 21:04 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 386368 [zhayujie CowAgent hasta 2.1.1 Self-Evolution Review Agent executor.py _select_tools escalada de privilegios] |
|---|
| Puntos | 20 |
|---|