{"schema":"threatline.record/2","record":{"id":"CVE-2026-116066","aliases":[],"summary":"Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service","details":"Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.","categories":["Unclassified"],"product":"Firecrawl","vendor":"Firecrawl","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116066","source_modified_at":"2026-10-25T11:50:55.818Z","fetched_at":"2026-10-25T16:01:37.004770Z","product":"Firecrawl","vendor":"Firecrawl","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"2.11.586"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116066","source_modified_at":"2026-10-25T11:50:55.818Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"name":"Firecrawl","ecosystem":null},"version":"2.11.586","basis":"first unaffected version stated in the CVE record"}],"cvss":7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-25T11:50:55.818Z","modified_at":"2026-10-25T11:50:55.818Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116066","fetched_at":"2026-10-25T16:01:37.004770Z","source_modified_at":"2026-10-25T11:50:55.818Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/firecrawl/firecrawl/issues/5256","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/firecrawl/firecrawl","tags":["product"]},{"source":"CVE List","url":"https://github.com/firecrawl/firecrawl/blob/5c198a7d9376fef21a7f6d74313fc957842744ad/apps/playwright-service-ts/api.ts#L47-L117","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/firecrawl/firecrawl/commit/5e74ff37b41ac650d6bccff170a9be0a6decb946","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/firecrawl-before-2.11.586-ssrf-protection-bypass-via-dns-rebinding-in-playwright-service","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-25T11:50:55.818Z","content_hash":"8bc821994b902972b24f25b8ce0505f858f0fd836a5a175c2c1edc4474015382"}}