---
id: "CVE-2026-116066"
kind: "vulnerability"
aliases: ["CVE-2026-116066"]
title: "Firecrawl: DNS rebinding lets scrape requests reach internal hosts"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-scraping", "ai-tooling", "cloud-metadata", "firecrawl", "self-hosted"]
not_affected_if: ["no-untrusted-scrape-targets", "version-2.11.586-or-later"]
published_at: "2026-10-25T12:16:27+00:00"
first_seen_at: "2026-10-25T12:40:44+00:00"
updated_at: "2026-10-25T12:41:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116066", "first_seen_at": "2026-10-25T12:40:44+00:00"}]
---

# Firecrawl: DNS rebinding lets scrape requests reach internal hosts

Firecrawl's Playwright service SSRF protection can be bypassed with DNS rebinding, because the host is validated at one address and then connected at a private one. An attacker who controls DNS for a scrape target can reach cloud metadata endpoints and internal services through the scrape API.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Firecrawl version in the deployed image or package, for example `firecrawl --version` or the tag of the running container, and compare it to `2.11.586`.
- Confirm whether the Playwright service is deployed alongside the API, which the sources do not state explicitly; unknown.

## Fix

- Upgrade Firecrawl to `2.11.586` or later.
- Until upgraded, restrict outbound network access from the scraper host to internal ranges and cloud metadata addresses at the network layer.

## Timeline

- 2026-10-25T12:40:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116066

## From the sources

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_