CVE-2026-116066: Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it if they can submit a scrape target through the scrape API and control DNS responses for that target. Exploitation requires returning a public IP address during SSRF validation and a private IP address when the Playwright service connects.
What resources could be exposed?
The issue can be used to retrieve cloud metadata and internal resources reachable by the Playwright service. Confidentiality impact is rated high; the provided data does not identify integrity or availability impact.
Which deployments are affected?
Firecrawl versions before 2.11.586 are affected in the Playwright service SSRF proxy. The provided information does not state whether the Playwright service is enabled or exposed in a default deployment.
How can I determine whether I am vulnerable?
Check the deployed Firecrawl version and whether scrape requests are handled through the Playwright service SSRF proxy. Versions before 2.11.586 should be treated as affected when attackers can supply scrape target hostnames.