What happened
CVE-2026-116066, published by VulnCheck and the NVD on October 25, 2026 (CVSS 4.0 score 7.0, high), affects Firecrawl before version 2.11.586. Firecrawl's Playwright service checked that a scrape target's hostname resolved to a public address, then resolved it again when connecting, so an attacker who controls DNS for a target can switch it to a private address in between and pull cloud metadata or internal resources through the scrape API. The fix was merged as commit 5e74ff3 on October 21. (VulnCheck advisory: Firecrawl before 2.11.586 SSRF protection bypass via DNS rebinding, Oct. 25, 2026)
What it means for Canada: our assessment
No Canadian victims have been reported. This is our assessment: Canadian companies that self-host Firecrawl to feed AI agents, chatbots and retrieval (RAG) systems are exposed if their deployment is older than the fix, because a scrape request could reach cloud instance metadata in Canadian AWS, Azure or Google Cloud regions and leak temporary credentials.
- Sectors
- AI startups and SaaS companies · Marketing, SEO and research agencies · Banks and insurers building internal AI assistants · Media and e-commerce firms running scraping pipelines
- Tools involved
- Self-hosted Firecrawl (before 2.11.586) · AI agents and RAG pipelines that call a Firecrawl scrape API · Cloud instance metadata services on AWS, Azure and Google Cloud
- Canadian rules
- PIPEDA: if leaked cloud credentials expose personal information, a breach with a real risk of significant harm must be reported to the Privacy Commissioner and affected people notified
Quebec Law 25: confidentiality incidents involving personal information must be reported to the Commission d'accès à l'information and logged
OSFI B-13: federally regulated financial institutions must patch and manage vulnerabilities in technology they run, including open-source AI tooling
OSFI B-10: institutions remain accountable for risks from third-party and open-source components they depend on
Assessment, not documented exposure. Firecrawl is a popular open-source tool for turning web pages into AI-ready text, and the advisory describes an attack that needs no authentication beyond access to the scrape API. Any Canadian organization running an unpatched self-hosted copy in a cloud environment faces the same exposure; whether the hosted firecrawl.dev service was affected is not stated in the advisory.
Takeaways for Canadian businesses
- BusinessIf you self-host Firecrawl, update to 2.11.586 or a build that includes commit 5e74ff3 (merged October 21, 2026), and rebuild the Playwright service container.
- BusinessBlock the Firecrawl and Playwright containers from reaching 169.254.169.254 and other private address ranges at the network or firewall level, so a DNS trick cannot reach metadata even if the app check fails.
- BusinessOn AWS, require IMDSv2 (session tokens) on instances that run scrapers, which blocks simple metadata reads through a forwarding proxy.
- BusinessPut the scrape API behind authentication and per-key limits, and review its logs for requests to unusual hostnames since your last update; rotate the cloud role credentials if anything looks off.
For the Canadian AI sector
Scrapers and URL-fetch tools are the main way agents pull outside content, which makes them a prime SSRF target. Canadian AI builders should treat any tool that fetches URLs on an agent's behalf as an internet-facing service that needs network isolation.
Written by AgentsNorth from the source below. General information, not legal or security advice.