CVE-2026-67346

Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass

Published Jul 30, 2026 CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Description

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.

Analysis

Technical impact

A flaw in the _is_safe_url function of Swarms causes hostnames supplied by users to be validated only after DNS resolution, allowing attackers to supply image or audio URLs that resolve to private, loopback or metadata addresses. This bypasses the service blocklist and permits the server to reach internal resources and exfiltrate credentials, a classic Server‑Side Request Forgery scenario described by CWE‑918.

Affected Systems

The vulnerability affects Swarms versions up to and including 6.8.1, as used by the vendor kyegomez. The bug was fixed with commit 8b0fc9e4645603ad94d5fcf4da86e3b9c71f4743.

Risk and Exploitability

The CVSS score of 7.7 indicates a high‑severity flaw, and the EPSS score of 0.0029 (less than 1%) suggests a very low but non‑zero probability of exploitation, with none listed in KEV. Attackers can trigger the vulnerability by submitting a malicious media URL that the server will fetch, potentially discovering internal endpoints or credentials. The vulnerability is exploitable without special conditions, making it a significant threat if left unpatched.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

kyegomez

swarms

unaffected

Version	Status	Constraints
`0`	affected	≤ 6.8.1
`8b0fc9e4645603ad94d5fcf4da86e3b9c71f4743`	unaffected	—

No data.

Vendor Product Versions

Kyegomez

Swarms

Version	Status	Scheme	Platform
`[0,6.8.1]`	affected	semver	—
`8b0fc9e4645603ad94d5fcf4da86e3b9c71f4743`	unaffected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Swarms to a version that incorporates commit 8b0fc9e or later, or rebuild from source applying that patch
Configure the application to reject all URLs that resolve to private, loopback or internal IP ranges before they are fetched
If an upgrade is not immediately possible, disable the media upload endpoint that accepts remote URLs or isolate the Swarms instance from internal networks to prevent outbound connections to internal services

Generated by OpenCVE AI on August 2, 2026 at 05:17 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.506% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/kyegomez/swarms/commit/8b0fc9e4645603ad94d5fcf4da86e3b9c71f4743
https://github.com/kyegomez/swarms/issues/1714
https://github.com/kyegomez/swarms/pull/1734
https://www.vulncheck.com/advisories/swarms-server-side-request-forgery-via-dns-rebinding-bypass

History

Jul 30, 2026 8:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Kyegomez Kyegomez swarms
Vendors & Products		Kyegomez Kyegomez swarms

Jul 30, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 30, 2026 3:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.
Title		Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass
Weaknesses		CWE-918
References		https://github.com/kyegomez/swarms/commit/8b0fc9e4645603ad94d5fcf4da86e3b9c71f4743 https://github.com/kyegomez/swarms/issues/1714 https://github.com/kyegomez/swarms/pull/1734 https://www.vulncheck.com/advisories/swarms-server-side-request-forgery-via-dns-rebinding-bypass
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}` cvssV4_0 `{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N'}`