CVE-2026-116066 Details
Description
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.
A server-side request forgery (SSRF) vulnerability has been identified in Firecrawl versions prior to 2.11.586. This vulnerability exists within the Playwright service's SSRF proxy, allowing attackers to bypass internal host checks through DNS rebinding. By controlling the DNS for a target being scraped, an attacker can manipulate the response to first provide a public address during validation and then a private address when the connection is made. This exploitation could lead to unauthorized access to cloud metadata and internal resources via the scrape API.
Users can update Firecrawl to version 2.11.586 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/firecrawl/firecrawl/issues/5256 | CISA-ADP | Issue TrackingTechnical DescriptionVendor |
| https://github.com/firecrawl/firecrawl | [email protected] | ProductSource CodeVendor |
| https://github.com/firecrawl/firecrawl/blob/5c198a7d9376fef21a7f6d74313fc957842744ad/apps/playwright-service-ts/api.ts#L47-L117 | [email protected] | |
| https://github.com/firecrawl/firecrawl/commit/5e74ff37b41ac650d6bccff170a9be0a6decb946 | [email protected] | Source CodeVendor |
| https://github.com/firecrawl/firecrawl/issues/5256 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/firecrawl-before-2.11.586-ssrf-protection-bypass-via-dns-rebinding-in-playwright-service | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Firecrawl | >= 0, < 2.11.586 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |