CVE-2026-67346 is a server-side request forgery vulnerability affecting kyegomez swarms versions up to and including 6.8.1. The root cause is a failure in the _is_safe_url function to properly validate hostnames through DNS resolution, enabling attackers to bypass hostname blocklists. By providing user-controlled image or audio URLs that resolve to internal network addresses such as private, loopback, or metadata IPs, attackers can cause the server to make unauthorized requests to internal services, potentially leading to credential exfiltration. The vulnerability was addressed in commit 8b0fc9e, which presumably corrects the hostname validation logic.

An attacker can exploit this SSRF vulnerability to make the vulnerable server perform unauthorized requests to internal network resources, including private, loopback, or metadata endpoints. This can lead to unauthorized access to internal services and exfiltration of sensitive credentials or information. The vulnerability does not require privileges or user interaction and has a high impact on confidentiality due to potential credential exposure.

A fix for this vulnerability is available and was implemented in commit 8b0fc9e. Users should upgrade to a version of swarms that includes this commit or later. Since the product is not a cloud service, remediation requires applying the official fix. Patch status is not explicitly confirmed in the advisory, so users should verify the presence of the fix in their deployed version. Until patched, avoid processing untrusted URLs that could resolve to internal addresses.