CVE-2026-67346 — Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS res…
Published: 2026-07-30 · CVSS: 7.7 · CVSS 4.0
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7