Server-Side Request Forgery Vulnerability in Swarms by Kyegomez
CVE-2026-67346

7.7HIGH

Key Information:

Vendor

Kyegomez

Status
Swarms
Vendor
CVE Published:
30 July 2026

What is CVE-2026-67346?

Swarms version 6.8.1 contains a vulnerability in the _is_safe_url function, which inadequately validates hostnames during DNS resolution. This flaw allows attackers to exploit user-provided image or audio URLs that resolve to private, loopback, or metadata addresses. Consequently, this enables unauthorized access to internal services, posing significant security risks including the potential exfiltration of sensitive credentials.

Affected Version(s)

swarms 0 <= 6.8.1

swarms 8b0fc9e4645603ad94d5fcf4da86e3b9c71f4743

References

https://github.com/kyegomez/swarms/issues/1714
technical-description
https://github.com/kyegomez/swarms/pull/1734
issue-tracking
https://github.com/kyegomez/swarms/commit/8b0fc9e4645603a...
patch

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.