CVE-2026-32857 - Vulnerability Analysis

Overview

Firecrawl <= 2.8.0 contains a server-side request forgery protection bypass caused by incomplete network policy validation on redirected URLs in the Playwright scraping service, letting attackers access internal network services via redirects, exploit requires attacker to supply a valid external URL that redirects internally.

Severity & Score

Impact

Attackers can access internal network services and sensitive endpoints by bypassing SSRF protections via redirects.

Mitigation

Update to the latest version beyond 2.8.0.

References

• https://github.com/firecrawl/firecrawl/security/advisories/GHSA-vjp8-2wgg-p734
• https://www.firecrawl.dev/
• https://www.vulncheck.com/advisories/firecrawl-playwright-service-ssrf-protection-bypass-via-missing-post-redirect-validation

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 29, 2026

🟠 CVE-2026-32857 - High (8.6) Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-supplied URL and not to subsequen... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32857/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner