CVE-2026-32857

Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-supplied URL and not to subsequent redirect destinations. Attackers can supply an externally valid URL that passes validation and returns an HTTP redirect to an internal or restricted resource, allowing the browser to follow the redirect and fetch the final destination without revalidation, thereby gaining access to internal network services and sensitive endpoints. This issue is distinct from CVE-2024-56800, which describes redirect-based SSRF generally. This vulnerability specifically arises from a post-redirect enforcement gap in implemented SSRF protections, where validation is applied only to the initial request and not to the final redirected destination.

• CWE-918

• https://github.com/firecrawl/firecrawl/security/advisories/GHSA-vjp8-2wgg-p734
• https://www.firecrawl.dev/
• https://www.vulncheck.com/advisories/firecrawl-playwright-service-ssrf-protection-bypass-via-missing-post-redirect-validation

Published

Mar 26, 2026

Last Modified

Jul 14, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32850MailEnable versions prior to 10.55 contain a reflected cross…6.1
• CVE-2026-32851MailEnable versions prior to 10.55 contain a reflected cross…6.1
• CVE-2026-32852MailEnable versions prior to 10.55 contain a reflected cross…6.1
• CVE-2026-32853LibVNCServer versions 0.9.15 and prior (fixed in commit 0090…8.1
• CVE-2026-32854LibVNCServer versions 0.9.15 and prior (fixed in commit dc78…7.5
• CVE-2026-32856Ellucian Banner Self-Service before the April T2 release (20…6.1
• CVE-2026-32859ByteDance DeerFlow versions prior to commit 5dbb362 contain …5.4
• CVE-2026-3286A vulnerability was identified in itwanger paicoding 1.0.0/1…4.3
• CVE-2026-32860There is a memory corruption vulnerability due to an out-of-…8.5
• CVE-2026-32861There is a memory corruption vulnerability due to an out-of-…8.5
• CVE-2026-32862There is a memory corruption vulnerability due to an out-of-…8.5
• CVE-2026-32863There is a memory corruption vulnerability due to an out-of-…8.5