What is CVE-2026-116066?

CVE-2026-116066 is a medium-severity vulnerability in Firecrawl, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.8/10. Published 2026-10-25.

How severe is CVE-2026-116066?

Medium severity. CVSS v3 base score is 6.8 out of 10.

SSRF in Firecrawl

CVE-2026-116066

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.

Vulnerability class: SSRF (Server-Side Request Forgery)

Published 2026-10-25 · last modified 2026-10-25.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Firecrawl

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

github.com/firecrawl/firecrawl/issues/5256 (issue-tracking)
github.com/firecrawl/firecrawl (product)
github.com/firecrawl/firecrawl/blob/5c198a7d9376fef21a7f6d74313fc957842744ad/ap… (technical-description)
github.com/firecrawl/firecrawl/commit/5e74ff37b41ac650d6bccff170a9be0a6decb946 (patch)
www.vulncheck.com/advisories/firecrawl-before-2.11.586-ssrf-protection-bypass-v… (third-party-advisory)

Frequently asked questions

What is CVE-2026-116066?: CVE-2026-116066 is a medium-severity vulnerability in Firecrawl, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.8/10. Published 2026-10-25.
How severe is CVE-2026-116066?: Medium severity. CVSS v3 base score is 6.8 out of 10.