CVE-2026-116066
Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service
Firecrawl Firecrawl
CVSS
7.0HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 2.11.586FirecrawlCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.
Text from CVE List
Affected versions 1
- Firecrawlaffected: all versions before 2.11.586CVE List
References 5
- github.com/firecrawl/firecrawl/commit/5e74ff37b41ac650d6bccff170a9be0a6decb946Fixvia CVE List
- vulncheck.com/advisories/firecrawl-before-2.11.586-ssrf-protection-bypass-via-dns-rebinding-in-playwright-serviceAdvisoryvia CVE List
- github.com/firecrawl/firecrawl/issues/5256Referencevia CVE List
- github.com/firecrawl/firecrawlReferencevia CVE List
- github.com/firecrawl/firecrawl/blob/5c198a7d9376fef21a7f6d74313fc957842744ad/apps/playwright-service-ts/api.ts#L47-L117Referencevia CVE List