Executive brief
Swarms is a framework for building and deploying AI agents. A security flaw allows attackers to trick these agents into making unauthorized network requests to internal systems. This could lead to the theft of sensitive cloud credentials or access to private internal services that are not intended to be exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `_is_safe_url` function within `swarms/utils/image_file_b64.py` and the audio loader in `litellm_wrapper.py`. The validation logic only checked for literal IP addresses and failed to resolve hostnames before applying blocklist filters. An attacker can provide a URL with a hostname that resolves to a private, loopback, or cloud metadata address (e.g., 169.254.169.254). This allows the attacker to bypass the guard and force the server to fetch content from internal resources, potentially exfiltrating sensitive data or credentials. The issue is fixed in commit 8b0fc9e by implementing DNS resolution and address normalization during validation.
Affected products
- kyegomez swarms <= 6.8.1
Timeline
- 2026-06-11: disclosed: Initial report to maintainer via email
- 2026-07-13: other: Public GitHub issue opened after no response
- 2026-07-27: patched: Fix merged in commit 8b0fc9e
- 2026-07-30: advisory: CVE published and NVD entry created