Firecrawl CVE-2026-72904

Requires a valid, authenticated Firecrawl API request to the extraction endpoint (the description states 'an authenticated attacker,' which conflicts with the vendor CVSS PR:N - treat authentication as required). The attacker must supply a crafted JSON schema with a $ref placed specifically inside a default, const, or enum field, because those keywords are not traversed by AJV validation and therefore bypass sanitization while still being resolved by json-schema-ref-parser's default file/http resolvers. Successful data return depends on triggering a dereference error so the resolved content is embedded in the persisted error message surfaced through the API. Limiting factors: the target file must be readable by the extract worker process, SSRF targets must be reachable from the worker's network position, and instances running 2.11.32 or later, or configurations that block $ref-bearing schemas, are not exploitable.

This is a genuine high-priority issue rather than a CVSS-inflated one: the impact is concrete (read any file the extract worker can access, plus SSRF to cloud-metadata and internal services), and the fix commit itself proves exploitability with working regression tests. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC/VI/VA:H) scores 9.3, but there is a material conflict: the description explicitly says 'an authenticated attacker,' which contradicts PR:N - realistic exploitation requires a valid Firecrawl API key, so effective privilege is low rather than none, and defenders running the hosted API or a multi-tenant self-hosted instance should treat any key-holder as a potential attacker. Confidentiality impact is the clear win for the attacker (file exfiltration + metadata credential theft via SSRF); the vendor's VI:H/VA:H rating is arguably generous since the primary mechanism is read/exfiltration, not modification or denial. There is no CISA KEV entry and no public exploit identified, and no EPSS score was provided, so exploitation is currently theoretical-but-trivial rather than observed in the wild - still, given that a self-hosted Firecrawl on a cloud VM exposes instance-metadata credentials through this SSRF, even a modest operator should patch promptly. Weighing the signals together: high technical impact, low practical barrier (authenticated network access), no confirmed active exploitation - prioritize as a fast-track patch.

An attacker with a valid Firecrawl API key submits an extraction job whose JSON schema hides a $ref such as file:///proc/self/environ or http://169.254.169.254/latest/meta-data/iam/security-credentials/ inside a default or enum field that AJV skips but the ref parser still resolves. They intentionally malform the reference so dereferencing fails, and the resolved file/endpoint content is captured in the persisted error message returned by the extraction API, exfiltrating local secrets or cloud IAM credentials. No public exploit is identified, but the vendor's own regression tests demonstrate the exact file:// and metadata-endpoint vectors.