CVE-2026-32857 - Vulnerability Analysis

Overview

Firecrawl <= 2.8.0 contains a server-side request forgery protection bypass caused by incomplete network policy validation on redirected URLs in the Playwright scraping service, letting attackers access internal network services via redirects, exploit requires attacker to supply a valid external URL that redirects internally.

Severity & Score

Impact

Attackers can access internal network services and sensitive endpoints by bypassing SSRF protections via redirects.

Mitigation

Update to the latest version beyond 2.8.0.

References

• https://github.com/firecrawl/firecrawl/security/advisories/GHSA-vjp8-2wgg-p734
• https://www.firecrawl.dev/
• https://www.vulncheck.com/advisories/firecrawl-playwright-service-ssrf-protection-bypass-via-missing-post-redirect-validation

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner