CVE-2026-116066 Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116066?
CVE-2026-116066 is a high-severity vulnerability in Firecrawl, published on 25 Oct 2026.
Official description
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.
Weakness: CWE-918
Which versions are affected by CVE-2026-116066?
How do I fix CVE-2026-116066?
No fix has been published for CVE-2026-116066 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116066 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116066 exists.
Sources
Also known as GHSA-xmmq-vp8j-m5qf.