CVE-2026-85606 Overview
CVE-2026-85606 is an arbitrary local file read vulnerability in firecrawl-mcp-server version 3.20.2. The flaw resides in the firecrawl_parse tool, which accepts a filePath argument without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files such as credentials, private keys, and environment variables. The file contents are then uploaded and returned to the model context, exposing them to any consumer of the Model Context Protocol (MCP) session. The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Critical Impact
Unauthenticated attackers reachable over the MCP interface can exfiltrate arbitrary local files, including .env files, SSH keys, and cloud credentials, by abusing the unvalidated filePath argument.
Affected Products
- firecrawl-mcp-server version 3.20.2
- Firecrawl MCP Server deployments exposing the firecrawl_parse tool
- MCP client integrations consuming vulnerable server versions
Discovery Timeline
- 2026-09-04 - CVE-2026-85606 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-85606
Vulnerability Analysis
The firecrawl_parse tool in firecrawl-mcp-server accepts a caller-supplied filePath parameter and reads the referenced file from the host filesystem. The implementation does not enforce a base directory, normalize the path, or reject traversal sequences. As a result, any path the server process can resolve, including absolute paths outside the intended working directory, is treated as valid input.
Once the file is read, its contents are forwarded through the MCP response channel and returned into the model context. This turns a server-side file read into a data-exfiltration primitive, because the model output is visible to the requesting client and any downstream logging or telemetry.
Because MCP servers frequently run alongside developer tooling and AI agents, the process typically has read access to configuration files, secret stores, and user home directories. Details of the vulnerable code path are documented in the VulnCheck Advisory and the GitHub Issue #306 Discussion.
Root Cause
The root cause is missing input validation on the filePath argument. The handler lacks canonicalization with path.resolve, containment checks against an allow-listed base directory, and rejection of absolute paths or .. segments. Any client that can invoke the tool controls the target of the read.
Attack Vector
An attacker with the ability to send tool calls to a vulnerable MCP server invokes firecrawl_parse with a crafted filePath such as /etc/passwd, /home/user/.aws/credentials, or ../../.env. The server reads the file, uploads its contents, and returns them in the tool response. Interaction with the underlying Firecrawl code is available in the firecrawl-mcp-server source on GitHub.
No authentication or user interaction is required in the vulnerable configuration. Exploitation succeeds against any target path readable by the MCP server process.
Detection Methods for CVE-2026-85606
Indicators of Compromise
- MCP tool invocations of firecrawl_parse where the filePath argument contains absolute paths, .. sequences, or URI schemes such as file://.
- Server-side reads of sensitive files (/etc/passwd, /etc/shadow, .env, id_rsa, credentials) initiated by the firecrawl-mcp-server process.
- Outbound uploads or model responses containing recognizable credential material sourced from the MCP server.
Detection Strategies
- Instrument the MCP server to log every filePath value passed to firecrawl_parse and alert on paths outside the intended working directory.
- Deploy filesystem auditing (auditd, Sysmon FileCreate/FileRead) on hosts running the MCP server, filtered by the server process ID.
- Inspect model context and LLM gateway logs for content patterns matching secrets, private keys, or shell configuration files returned by tool responses.
Monitoring Recommendations
- Continuously monitor process-to-file access relationships for the Node.js runtime hosting firecrawl-mcp-server.
- Alert on tool responses whose payload size or entropy deviates from the baseline for normal parse operations.
- Correlate MCP client identities with the paths they request to detect anomalous or scripted enumeration behavior.
How to Mitigate CVE-2026-85606
Immediate Actions Required
- Upgrade firecrawl-mcp-server to a fixed release beyond 3.20.2 as tracked in the Firecrawl MCP Server repository.
- Rotate any credentials, tokens, API keys, and SSH keys accessible to the account running the MCP server, assuming exposure.
- Restrict network reachability of the MCP server to trusted clients only, using host firewalls or a reverse proxy with authentication.
Patch Information
Refer to the VulnCheck Advisory and GitHub Issue #306 for the latest guidance on fixed versions. Updated source is published in the firecrawl-mcp-server repository, including the v3.24.1 index.ts reference.
Workarounds
- Run the MCP server under a dedicated low-privilege user account with read access limited to a single working directory.
- Wrap the server in a sandbox such as a container, bwrap, or systemd unit with ProtectHome=yes and ReadOnlyPaths= restricting the reachable filesystem.
- Introduce a proxy or middleware that validates filePath arguments, rejects absolute paths and traversal sequences, and enforces an allow-listed base directory.
# Configuration example: hardened systemd unit for firecrawl-mcp-server
[Service]
User=firecrawl
Group=firecrawl
WorkingDirectory=/var/lib/firecrawl
ExecStart=/usr/bin/node /opt/firecrawl-mcp-server/dist/index.js
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
ReadOnlyPaths=/opt/firecrawl-mcp-server
ReadWritePaths=/var/lib/firecrawl
InaccessiblePaths=/etc/ssh /root /home
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
