CVE-2026-32857: SSRF in Firecrawl Playwright Scraping

The SSRF vulnerability in Firecrawl arises from insufficient validation of redirect destinations. An attacker can craft a malicious URL that initially passes validation but redirects to an internal resource. Because the validation only occurs on the initial URL, the browser will follow the redirect without further checks, effectively bypassing the intended security controls. This allows attackers to access internal APIs, databases, or other sensitive services that are not directly exposed to the internet. The potential blast radius is significant, as an attacker could leverage this vulnerability to map the internal network, steal credentials, or even execute arbitrary code depending on the exposed services.

1. Reserved2026-03-16
2. Published2026-03-26
3. Modified2026-03-30
4. EPSS updated2026-04-03

While a patched version of Firecrawl is the ultimate solution, several mitigation strategies can be implemented in the interim. First, implement strict URL validation and redirect filtering at the proxy or WAF level. This should include checking the destination URL after any redirects occur. Second, consider disabling redirects altogether if they are not essential for the application's functionality. Third, implement network segmentation to limit the potential impact of a successful SSRF attack. Finally, monitor network traffic for suspicious outbound requests originating from the Firecrawl service. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a known malicious URL and verifying that the request is blocked.