PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains a server-side request forgery issue in the optional scheduler's webhook delivery path. When a task is submitted to `POST /tasks` with a user-controlled `callbackUrl`, the v0.8.3 scheduler sends an outbound HTTP `POST` to that URL when the task reaches a terminal state. In that release, the webhook path validated only the URL scheme and did not reject loopback, private, link-local, or other non-public destinations. Because the v0.8.3 implementation also used the default HTTP client behavior, redirects were followed and the destination was not pinned to validated IPs. This allowed blind SSRF from the PinchTab server to attacker-chosen HTTP(S) targets reachable from the server. This issue is narrower than a general unauthenticated internet-facing SSRF. The scheduler is optional and off by default, and in token-protected deployments the attacker must already be able to submit tasks using the server's master API token. In PinchTab's intended deployment model, that token represents administrative control rather than a low-privilege role. Tokenless deployments lower the barrier further, but that is a separate insecure configuration state rather than impact created by the webhook bug itself. PinchTab's default deployment model is local-first and user-controlled, with loopback bind and token-based access in the recommended setup. That lowers practical risk in default use, even though it does not remove the underlying webhook issue when the scheduler is enabled and reachable. This was addressed in v0.8.4 by validating callback targets before dispatch, rejecting non-public IP ranges, pinning delivery to validated IPs, disabling redirect following, and validating `callbackUrl` during task submission.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab
    v0.8.3 contains a server-side request forgery issue in the optional scheduler's webhook delivery path.
    When a task is submitted to `POST /tasks` with a user-controlled `callbackUrl`, the v0.8.3 scheduler sends
    an outbound HTTP `POST` to that URL when the task reaches a terminal state. In that release, the webhook
    path validated only the URL scheme and did not reject loopback, private, link-local, or other non-public
    destinations. Because the v0.8.3 implementation also used the default HTTP client behavior, redirects were
    followed and the destination was not pinned to validated IPs. This allowed blind SSRF from the PinchTab
    server to attacker-chosen HTTP(S) targets reachable from the server. This issue is narrower than a general
    unauthenticated internet-facing SSRF. The scheduler is optional and off by default, and in token-protected
    deployments the attacker must already be able to submit tasks using the server's master API token. In
    PinchTab's intended deployment model, that token represents administrative control rather than a low-
    privilege role. Tokenless deployments lower the barrier further, but that is a separate insecure
    configuration state rather than impact created by the webhook bug itself. PinchTab's default deployment
    model is local-first and user-controlled, with loopback bind and token-based access in the recommended
    setup. That lowers practical risk in default use, even though it does not remove the underlying webhook
    issue when the scheduler is enabled and reachable. This was addressed in v0.8.4 by validating callback
    targets before dispatch, rejecting non-public IP ranges, pinning delivery to validated IPs, disabling
    redirect following, and validating `callbackUrl` during task submission. (CVE-2026-33619)

ID	Name	Product	Family	Severity
439172	SCA: security update for github.com/pinchtab/pinchtab (GHSA-xqq2-4j46-vwp7)	Tenable Cloud Security	SCA Checks	medium
439172	SCA: security update for github.com/pinchtab/pinchtab (GHSA-xqq2-4j46-vwp7)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-33619

medium

Tenable Plugins

medium

medium