Server-Side Request Forgery Vulnerability in Firecrawl's Playwright Service
CVE-2026-116066

7HIGH

Key Information:

Vendor: Firecrawl
Status: Firecrawl
Vendor: CVE Published:; 25 October 2026

What is CVE-2026-116066?

The Playwright service in Firecrawl prior to version 2.11.586 is vulnerable to a server-side request forgery (SSRF) attack due to misconfigurations in its proxy service. This vulnerability allows an attacker controlling DNS for a scraped target to manipulate validations, returning a public address during the initial phase and subsequently redirecting to a private address during connection. This exploit can lead to unauthorized access to cloud metadata and internal resources via the scrape API, posing significant security risks.