CVE-2026-116066
Deferred Deferred - Pending Action

Firecrawl Playwright SSRF via DNS Rebinding Before 2.11.586

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116066
EUVD
EUVD-2026-109380

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Firecrawl Firecrawl 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Firecrawl before version 2.11.586 has a Server-Side Request Forgery (SSRF) vulnerability in its Playwright service. The issue occurs because the service performs DNS resolution twice: once during a safety check and again during the actual connection. Attackers controlling DNS for a target can exploit this by returning a public IP during validation and a private IP during connection, bypassing internal host restrictions. This allows access to cloud metadata and internal resources through the scrape API.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual SSRF proxy requests in Firecrawl's Playwright service. Check logs for DNS rebinding attempts or connections to internal IPs from the scrape API. Use tools like tcpdump or Wireshark to inspect traffic between the Playwright service and internal hosts.

Impact Analysis

If you use Firecrawl versions before 2.11.586, attackers could exploit this flaw to access internal network resources, including cloud metadata endpoints or admin panels. Even free-tier users might gain unauthorized access to sensitive data or systems within Firecrawl's private network. This could lead to data leaks, unauthorized actions, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy). Unauthorized access to internal resources may result in data breaches, triggering regulatory penalties, legal liabilities, and reputational damage for organizations using affected Firecrawl versions.

Mitigation Strategies

Upgrade Firecrawl to version 2.11.586 or later to apply the DNS rebinding fix. Ensure the SSRF proxy pins DNS resolutions and rejects non-unicast addresses. Review and restrict access to internal resources via the scrape API until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116066. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart