Firecrawl CVE-2026-116066

The attacker must control the authoritative DNS for a hostname they can submit to Firecrawl's scrape API, and must set a low/zero TTL so the name resolves differently between the isInternalHost validation lookup and the Playwright proxy's connection - returning a routable public address during validation and a private/link-local address (e.g. the 169.254.169.254 cloud metadata IP or RFC1918 ranges) at connect time. Exploitation applies to the default blocking path where ALLOW_LOCAL_WEBHOOKS is not enabled (that is the path isInternalHost guards). Limiting factors: success depends on winning the timing window between the two resolutions (AT:P / the DNS-rebinding race), the attacker must operate attacker-controlled authoritative DNS, and the deployment must expose the scrape API to the attacker; affected only before version 2.11.586.

This is a genuine but second-tier priority. The authoritative CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L, 7.0) tells a coherent story: network-reachable and unauthenticated (PR:N), but gated by an attack requirement (AT:P) - the DNS-rebinding timing window between the isInternalHost validation lookup and the actual proxy connection, which is a TOCTOU condition the attacker does not fully control. Impact is concentrated in the subsequent system (SC:H): the vulnerable service itself leaks little (VC:L), but the SSRF pivots into cloud metadata and internal resources, so the real damage is credential/data exposure behind the proxy. Exploitation status is 'no public exploit identified at time of analysis' - no CISA KEV listing and no reference in the input marked as a working PoC (the links are the GitHub issue, repo, vulnerable source, patch commit, and the VulnCheck advisory). No EPSS score was provided in the input, so exploitation-probability cannot be compared against the other signals - this is a gap, not a low-likelihood finding. The vuln.today decision label is 'this_week', consistent with a network-reachable SSRF that reaches cloud metadata but requires attacker-controlled DNS and a timing race rather than trivial one-shot exploitation. Net: a real, patch-this-week issue for anyone running Firecrawl's Playwright service exposed to untrusted scrape targets, not an emergency drop-everything case.

An attacker registers a domain whose authoritative DNS they control with a very low TTL, then submits that URL to a Firecrawl scrape endpoint. During the isInternalHost validation the DNS answers with a public IP (passing the check), but on the subsequent proxy connection it answers with an internal address such as 169.254.169.254, so the Playwright SSRF proxy fetches the cloud instance metadata service and returns credentials or internal resource contents through the scrape API. No public exploit code is identified in the provided data, though the vulnerable code path and the fix are visible in the referenced source and patch commit.