VulDB 🛡@vuldb
🚨 Our CTI team identified a lot of activities targeting Firecrawl (CVE-2026-116066) vuldb.com/vuln/426200/cti https://t.co/yFQNE4YY2r
00000114
2.3K followersView on X
CVE-2026-116066
LOWCVSS 7.0 · HIGHSignal is active with 2 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/firecrawl/firecrawl
- https://github.com/firecrawl/firecrawl/blob/5c198a7d9376fef21a7f6d74313fc957842744ad/apps/playwright-service-ts/api.ts#L47-L117
- https://github.com/firecrawl/firecrawl/commit/5e74ff37b41ac650d6bccff170a9be0a6decb946
- https://github.com/firecrawl/firecrawl/issues/5256
- https://www.vulncheck.com/advisories/firecrawl-before-2.11.586-ssrf-protection-bypass-via-dns-rebinding-in-playwright-service
Weakness type (CWE)
CWE-918
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 2 mentions across 1 observed day
What's happening
- 2 total mentions across 1 day
Deep dive
Activity timeline2 mentions / 1d
Referenced assets1 URL
Full discourse2 posts
PJ@Npj8448🚨 Four new application flaws hit the wire: Firecrawl SSRF via DNS rebinding (CVE-2026-116066), YesWiki SQLi (CVE-2026-116211), Leon AI path traversal (CVE-2026-116054), and an SH3 hash weakness. Check your dev tooling inventory and patch immediately. https://pranithjain.qzz.io/threatintel/telegram?tab=firehose
000004693 followersView on X