{"id":"CVE-2026-116066","kind":"vulnerability","aliases":["CVE-2026-116066"],"related":[],"title":"Firecrawl: DNS rebinding lets scrape requests reach internal hosts","description":"Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.","summary":"Firecrawl's Playwright service SSRF protection can be bypassed with DNS rebinding, because the host is validated at one address and then connected at a private one. An attacker who controls DNS for a scrape target can reach cloud metadata endpoints and internal services through the scrape API.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-scraping","ai-tooling","cloud-metadata","firecrawl","self-hosted"],"not_affected_if":["no-untrusted-scrape-targets","version-2.11.586-or-later"],"how_to_check":"- Check the Firecrawl version in the deployed image or package, for example `firecrawl --version` or the tag of the running container, and compare it to `2.11.586`.\n- Confirm whether the Playwright service is deployed alongside the API, which the sources do not state explicitly; unknown.","fix":"- Upgrade Firecrawl to `2.11.586` or later.\n- Until upgraded, restrict outbound network access from the scraper host to internal ranges and cloud metadata addresses at the network layer.","status":"open","published_at":"2026-10-25T12:16:27+00:00","first_seen_at":"2026-10-25T12:40:44+00:00","triaged_at":"2026-10-25T12:41:24+00:00","updated_at":"2026-10-25T12:41:24+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T12:41:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Firecrawl to `2.11.586` or later.\n- Until upgraded, restrict outbound network access from the scraper host to internal ranges and cloud metadata addresses at the network layer.","reach":"internet","title":"Firecrawl: DNS rebinding lets scrape requests reach internal hosts","impact":"high","summary":"Firecrawl's Playwright service SSRF protection can be bypassed with DNS rebinding, because the host is validated at one address and then connected at a private one. An attacker who controls DNS for a scrape target can reach cloud metadata endpoints and internal services through the scrape API.","category":"ai-tooling","nicknames":[],"who_cares":["firecrawl","self-hosted","cloud-metadata","ai-scraping"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads cloud metadata credentials and internal services via scrape API","analyst_note":"Confirm from the Firecrawl release notes or advisory whether the Playwright service is on by default and whether scrape API calls need an account; the NVD entry does not say.","how_to_check":"- Check the Firecrawl version in the deployed image or package, for example `firecrawl --version` or the tag of the running container, and compare it to `2.11.586`.\n- Confirm whether the Playwright service is deployed alongside the API, which the sources do not state explicitly; unknown.","needs_analyst":true,"not_affected_if":["version-2.11.586-or-later","no-untrusted-scrape-targets"],"who_is_affected":"Self-hosted or managed Firecrawl deployments that run the Playwright scraping service and accept scrape requests from users or untrusted inputs are exposed, since the attacker supplies the target domain. Deployments that only scrape trusted internal URLs and do not accept untrusted target URLs are less exposed. Versions before 2.11.586 are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":3348,"output_tokens":692,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116066':12A,15A '-2026':11A,14A '2.11.586':79C 'address':48B,115C,121C 'ai':17B,20B 'ai-scrap':16B 'ai-tool':19B 'allow':95C 'api':76B,134C 'attack':57B,96C,104C 'bypass':37B,98C 'check':100C 'cloud':23B,67B,126C 'cloud-metadata':22B 'connect':51B,123C 'contain':80C 'control':59B,105C 'cve':10A,13A 'dns':2A,39B,60B,102C,106C 'endpoint':69B 'firecrawl':1A,25B,29B,77C 'forgeri':86C 'host':9A,28B,43B 'intern':8A,71B,129C 'isinternalhost':99C 'let':4A 'metadata':24B,68B,127C 'one':47B,55B 'playwright':31B,90C 'privat':54B,120C 'protect':34B 'proxi':93C 'public':114C 'reach':7A,66B 'rebind':3A,40B,103C 'request':6A,85C 'resourc':130C 'retriev':125C 'return':112C 'scrape':5A,18B,63B,75B,109C,133C 'self':27B 'self-host':26B 'server':83C 'server-sid':82C 'servic':32B,72B,91C 'side':84C 'ssrf':33B,92C 'target':64B,110C 'time':124C 'tool':21B 'valid':45B,117C 'via':101C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Firecrawl deployments that run the Playwright scraping service and accept scrape requests from users or untrusted inputs are exposed, since the attacker supplies the target domain. Deployments that only scrape trusted internal URLs and do not accept untrusted target URLs are less exposed. Versions before 2.11.586 are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T12:16:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116066","severity":null,"published_at":"2026-10-25T12:16:27+00:00","modified_at":"2026-10-25T12:16:28+00:00","first_seen_at":"2026-10-25T12:40:44+00:00","fetched_at":"2026-10-25T12:40:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}