Executive Summary

A server-side request forgery (SSRF) vulnerability exists in Firecrawl before version 2.11.586. This vulnerability, tracked as CVE-2026-116066, allows attackers to bypass internal host checks via DNS rebinding, potentially leading to the retrieval of cloud metadata and internal resources. The vulnerability has a CVSS score of 6.8, indicating medium severity.

Technical Analysis

The vulnerability is classified as a server-side request forgery (SSRF) issue, specifically in the Playwright service SSRF proxy of Firecrawl. The root cause of this vulnerability is the lack of proper validation in the isInternalHost checks, which can be bypassed through DNS rebinding. An attacker controlling the DNS for a scrape target can return a public address during validation and a private address at connect time, allowing them to access internal resources through the scrape API.

How It Gets Exploited

An attacker would need to control the DNS for a scrape target. During the validation process, the attacker would return a public address, making the target appear external and thus bypassing the isInternalHost checks. At connect time, the attacker would resolve the target to a private address, allowing them to access internal resources or cloud metadata through the scrape API. This could lead to unauthorized access to sensitive information.

Impact Assessment

Firecrawl versions before 2.11.586 are affected by this vulnerability. An attacker could exploit this vulnerability to retrieve cloud metadata and internal resources, potentially leading to further unauthorized access or data breaches. The CVSS score of 6.8 indicates a medium severity level, with impacts on confidentiality.

Recommended Actions

To mitigate this vulnerability, users of Firecrawl should update to version 2.11.586 or later. Additionally, implementing proper network segmentation and monitoring for suspicious DNS resolutions can help detect and prevent exploitation attempts. Users should also review their Firecrawl configurations to ensure that internal host checks are properly enforced.

Sources

  • National Vulnerability Database (NVD) - CVE-2026-116066