Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck

CVE-2026-67346Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass

High 8.6

In plain English

A high-severity server-side request forgery in swarms from kyegomez. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.

Affected products (as reported)

Vendor	Product	Versions
kyegomez	swarms	0 – through 6.8.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Researcher Disclosure technical-description, issue-tracking
Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/swarms-server-side-request-forgery-via-dns-rebinding-bypass third-party-advisory