Vulnerability Description
Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-supplied URL and not to subsequent redirect destinations. Attackers can supply an externally valid URL that passes validation and returns an HTTP redirect to an internal or restricted resource, allowing the browser to follow the redirect and fetch the final destination without revalidation, thereby gaining access to internal network services and sensitive endpoints. This issue is distinct from CVE-2024-56800, which describes redirect-based SSRF generally. This vulnerability specifically arises from a post-redirect enforcement gap in implemented SSRF protections, where validation is applied only to the initial request and not to the final redirected destination.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/firecrawl/firecrawl/security/advisories/GHSA-vjp8-2wgg-p734
- https://www.firecrawl.dev/
- https://www.vulncheck.com/advisories/firecrawl-playwright-service-ssrf-protectio
FAQ
What is CVE-2026-32857?
CVE-2026-32857 is a vulnerability with a CVSS score of 8.6 (HIGH). Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the...
How severe is CVE-2026-32857?
CVE-2026-32857 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-32857?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.