Is CVE-2026-116066 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116066?

CVE-2026-116066 has a CVSS v3 severity of MEDIUM (6.8).

Back

CVE-2026-116066

Description

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.