Which versions of Swarms are affected by CVE-2026-67346?

The kyegomez Swarms multi-agent framework (through version 6.8.1) contains a vulnerability that allows remote attackers to access internal systems and exfiltrate cloud credentials without…. A patch is available.

How to fix or mitigate CVE-2026-67346?

Within 24 hours, identify all systems running Swarms version 6.8.1 or earlier and assess exposure, particularly any agents configured to process image or audio URLs from untrusted sources. Within 7 days, deploy the vendor-released patch across all affected systems. Within 30 days, audit system and access logs for evidence of exploitation, review any credentials associated with affected systems for unauthorized use, and validate that all systems have been successfully patched.

Swarms CVE-2026-67346

Q: What is the CVSS score of CVE-2026-67346?

CVE-2026-67346 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51149 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-30 VulnCheck

GHSA-v37m-33r4-9ggf

SSRF Swarms

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network SSRF with scope change into internal/metadata services enabling credential exfiltration gives C:H; DNS-rebinding is achievable so AC:L, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 30, 2026 - 15:22 vuln.today

Analysis Generated

Jul 30, 2026 - 15:22 vuln.today

CVE Published

Jul 30, 2026 - 14:39 cve.org

HIGH 7.7

DescriptionCVE.org

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.

AnalysisAI

Server-side request forgery in the kyegomez Swarms multi-agent framework (all versions through 6.8.1) lets remote unauthenticated attackers coerce the server into fetching attacker-chosen internal endpoints. The flaw lives in the _is_safe_url blocklist check, which validates the literal hostname but never re-checks the address returned by DNS resolution - so a hostname that resolves to a private, loopback, or cloud-metadata address slips past the filter. Supplied as an image or audio URL to an agent, this can be abused to reach internal services and exfiltrate cloud credentials. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Swarms is an open-source Python framework for orchestrating multi-agent LLM workflows, which supports vision and audio agents that fetch user-supplied media URLs for model input. The vulnerability is a classic CWE-918 SSRF combined with a DNS-rebinding / TOCTOU weakness: the _is_safe_url guard parses the URL hostname and compares it against a blocklist of private/reserved ranges, but because it validates the hostname string rather than the resolved IP, an attacker-controlled DNS name that answers with a public address at check time (or simply resolves to an internal address the string filter did not anticipate) bypasses the control. The underlying HTTP client then connects to whatever the name resolves to at fetch time - including 127.0.0.1, RFC1918 ranges, and the 169.254.169.254 cloud metadata endpoint. The single affected product is identified by CPE cpe:2.3:a:kyegomez:swarms:*:*:*:*:*:*:*:* covering all releases up to and including 6.8.1.

RemediationAI

Upgrade to a build that includes the fix: Upstream fix available (PR #1734 / commit 8b0fc9e4645603ad94d5fcf4da86e3b9c71f4743); a released patched version was not independently confirmed from the provided data, so pin to or build from commit 8b0fc9e or later, referencing https://github.com/kyegomez/swarms/commit/8b0fc9e4645603ad94d5fcf4da86e3b9c71f4743 and the VulnCheck advisory. Until upgraded, the highest-value compensating control is to block the workload's egress to internal and metadata ranges - deny outbound access from the Swarms host to 127.0.0.0/8, RFC1918 ranges, and specifically 169.254.169.254 (trade-off: legitimate internal media fetches break), and on AWS enforce IMDSv2 with a hop limit of 1 to defang metadata credential theft. Where possible, disable or restrict agent features that fetch user-supplied image/audio URLs, or run the fetcher in a network-isolated sandbox/proxy that resolves and re-validates the destination IP after DNS resolution rather than trusting the hostname string. These controls reduce SSRF reach but do not fix the underlying validation gap, so treat them as temporary.