PT-2026-28444 · Microsoft+1 · Playright+1

Published 2026-03-26 · Updated 2026-05-01 · CVE-2026-32857

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firecrawl versions 2.8.0 and earlier

Description The software contains a server-side request forgery (SSRF) protection bypass in the Playwright scraping service. The network policy validation is applied only to the initial URL provided by the user and not to subsequent redirect destinations. An attacker can provide a valid URL that passes validation and redirects to an internal or restricted resource. The browser then follows the redirect and fetches the final destination without revalidation, potentially granting access to internal network services and sensitive endpoints. This issue differs from a general redirect-based SSRF. The problem stems from a gap in enforcement of SSRF protections after a redirect, where validation occurs only on the initial request, not the final redirected destination.

Recommendations Versions prior to 2.8.0 should be updated.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-32857

Affected Products

Firecrawl

Playright

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-32857 · Security Note
• https://github.com/firecrawl/firecrawl/security/advisories/GHSA-vjp8-2wgg-p734 · Note
• https://firecrawl.dev · Note
• https://t.me/cveNotify/161746 · Telegram Post
• https://twitter.com/CVEnew/status/2037280601867509770 · Twitter Post
• https://vulncheck.com/advisories/firecrawl-playwright-service-ssrf-protection-bypass-via-missing-post-redirect-validation · Note
• https://twitter.com/TheHackerWire/status/2038058917000077598 · Twitter Post
• https://twitter.com/infoflowcloud/status/2037281226092855660 · Twitter Post