{"id":"CVE-2026-116066","title":"Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service","summary":"Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target ca…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"Firecrawl","product":"Firecrawl","affected":["Firecrawl < 2.11.586"],"published":"2026-10-25","updated":"2026-10-25","sourceUpdated":"2026-10-25T11:50:55.818Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116066","references":[{"url":"https://github.com/firecrawl/firecrawl/issues/5256","label":"GitHub Issue #5256"},{"url":"https://github.com/firecrawl/firecrawl"},{"url":"https://github.com/firecrawl/firecrawl/blob/5c198a7d9376fef21a7f6d74313fc957842744ad/apps/playwright-service-ts/api.ts#L47-L117"},{"url":"https://github.com/firecrawl/firecrawl/commit/5e74ff37b41ac650d6bccff170a9be0a6decb946"},{"url":"https://www.vulncheck.com/advisories/firecrawl-before-2.11.586-ssrf-protection-bypass-via-dns-rebinding-in-playwright-service","label":"VulnCheck Advisory: Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service"}],"tags":["cve.org"],"ingestedAt":"2026-10-25T22:08:29.959Z","slug":"CVE-2026-116066","body":"## Overview\n\nFirecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.\n\n## Affected\n\n- `Firecrawl < 2.11.586`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}