Server-Side Request Forgery Bypass in Firecrawl by Firecrawl

CVE-2026-32857

What is CVE-2026-32857?

The Firecrawl Playwright scraping service is susceptible to a server-side request forgery (SSRF) protection bypass. This issue occurs when the network policy validation is performed exclusively on the initial user-supplied URL, neglecting any subsequent redirects. An attacker can exploit this by providing a valid external URL that passes validation, which can redirect to an internal resource. As a result, the browser may follow the redirect, gaining unauthorized access to sensitive internal network services and endpoints. This vulnerability highlights a significant gap in the implementation of SSRF protections, as it fails to validate the final destination post-redirect.

References