CVE-2026-67346

Deferred Deferred - Pending Action

Server-Side Request Forgery in Swarms

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-67346

EUVD

EUVD-2026-51149

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in Swarms through version 6.8.1. The issue lies in the _is_safe_url function, which does not properly validate hostnames through DNS resolution. Attackers can exploit this by providing user-controlled URLs for images or audio that resolve to private, loopback, or metadata addresses. This allows them to access internal services and potentially steal credentials.

Detection Guidance

Detecting this SSRF vulnerability requires checking for improper URL validation in the _is_safe_url function. Monitor network traffic for requests to private, loopback, or metadata IP addresses (e.g., 127.0.0.1, 169.254.169.254). Inspect logs for user-controlled URLs accessing internal services. Use tools like curl or wget to test if the application follows redirects to restricted addresses.

Impact Analysis

If you are using Swarms version 6.8.1 or earlier, attackers could exploit this SSRF vulnerability to access internal services within your network. This may lead to credential theft, unauthorized data access, or further attacks on internal systems. The impact depends on the services exposed and the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations using affected versions may face legal penalties, reputational damage, and increased scrutiny from regulators if a breach occurs.

Mitigation Strategies

Update to the patched version in commit 8b0fc9e or later to fix the _is_safe_url function's DNS resolution validation issue.

Hi! I’m here to help you understand CVE-2026-67346. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70