CVE-2026-30834

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30834", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-05T21:06:44.606Z", "datePublished": "2026-03-07T15:36:30.036Z", "dateUpdated": "2026-03-10T17:30:48.858Z"}, "containers": {"cna": {"title": "PinchTab: SSRF with Full Response Exfiltration via Download Handler", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/pinchtab/pinchtab/security/advisories/GHSA-rw8p-c6hf-q3pg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pinchtab/pinchtab/security/advisories/GHSA-rw8p-c6hf-q3pg"}], "affected": [{"vendor": "pinchtab", "product": "pinchtab", "versions": [{"version": "< 0.7.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T15:36:30.036Z"}, "descriptions": [{"lang": "en", "value": "PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server to make requests to arbitrary URLs, including internal network services and local system files, and exfiltrate the full response content. This issue has been patched in version 0.7.7."}], "source": {"advisory": "GHSA-rw8p-c6hf-q3pg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T17:30:03.844960Z", "id": "CVE-2026-30834", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:30:48.858Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30834", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T17:30:03.844960Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:30:44.088Z"}}], "cna": {"title": "PinchTab: SSRF with Full Response Exfiltration via Download Handler", "source": {"advisory": "GHSA-rw8p-c6hf-q3pg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pinchtab", "product": "pinchtab", "versions": [{"status": "affected", "version": "< 0.7.7"}]}], "references": [{"url": "https://github.com/pinchtab/pinchtab/security/advisories/GHSA-rw8p-c6hf-q3pg", "name": "https://github.com/pinchtab/pinchtab/security/advisories/GHSA-rw8p-c6hf-q3pg", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server to make requests to arbitrary URLs, including internal network services and local system files, and exfiltrate the full response content. This issue has been patched in version 0.7.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T15:36:30.036Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30834", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:30:48.858Z", "dateReserved": "2026-03-05T21:06:44.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-07T15:36:30.036Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pinchtab", "vendor": "pinchtab", "versions": [{"status": "affected", "version": "< 0.7.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pinchtab:pinchtab:*:*:*:*:*:*:*:*", "matchCriteriaId": "DB42832A-CF83-4457-89C8-A8CD2AEEE885", "versionEndExcluding": "0.7.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server to make requests to arbitrary URLs, including internal network services and local system files, and exfiltrate the full response content. This issue has been patched in version 0.7.7."}, {"lang": "es", "value": "PinchTab es un servidor HTTP independiente que otorga a los agentes de IA control directo sobre un navegador Chrome. Antes de la versi\u00f3n 0.7.7, una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en el endpoint /download permite a cualquier usuario con acceso a la API inducir al servidor PinchTab a realizar peticiones a URLs arbitrarias, incluyendo servicios de red internos y archivos del sistema local, y exfiltrar el contenido completo de la respuesta. Este problema ha sido parcheado en la versi\u00f3n 0.7.7."}], "id": "CVE-2026-30834", "lastModified": "2026-06-17T10:32:59.863", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30834", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T17:30:03.844960Z", "version": "2.0.3"}}]}, "published": "2026-03-07T16:15:56.057", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/pinchtab/pinchtab/security/advisories/GHSA-rw8p-c6hf-q3pg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.7.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pinchtab", "source": "cna", "vendor": "pinchtab"}, "product": "pinchtab", "vendor": "pinchtab"}], "analysis": {"en": {"generated_at": "2026-04-18T17:27:29.199260+00:00", "value": {"mitigation_remediation": ["Update PinchTab to version 0.7.7 or later, which contains the SSRF fix.", "Restrict API access to trusted users or network segments to limit the ability to trigger SSRF requests.", "If the patch cannot be applied immediately, temporarily disable or remove the /download endpoint or configure it to block internal or file URLs."], "summary": {"action": "Immediate Patch", "impact": "Full response exfiltration through SSRF in the /download endpoint"}, "threat_synthesis": {"affected_systems": "The vulnerability is present in PinchTab version 0.7.6 and earlier, a range inferred from the description that the issue was patched in 0.7.7. The affected product is PinchTab as identified by the vendor pinchtab:pinchtab.", "description_and_impact": "PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. The /download endpoint contains a server\u2011side request forgery weakness that allows any user who has API access to instruct the PinchTab server to make arbitrary HTTP requests. The server then returns the full response body to the attacker, enabling extraction of internal network data, local system files, or other sensitive resources. This flaw predominantly results in accidental or intentional confidentiality violations and could be used to surface sensitive information without authentication to the server itself.", "risk_and_exploitability": "The CVSS score of 7.5 places this flaw in the high severity range, but the EPSS value of less than 1% indicates a very low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires only API access, meaning that any user who can reach the PinchTab instance (for example, via a network or exposed API key) can trigger SSRF requests. The attacker can direct the server to any URL, including internal addresses and local file URLs, and retrieve the full content of the response. No additional preconditions are needed beyond API access, and the attacker can exploit the issue immediately without further setup."}}}}, "created": "2026-03-09T10:05:08.265745+00:00", "updated": "2026-04-18T17:30:05.958753+00:00", "vendors": ["pinchtab", "pinchtab$PRODUCT$pinchtab"]}