Threat Investigation
Request a demo

CVE-2026-30834

High

Description

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server to make requests to arbitrary URLs, including internal network services and local system files, and exfiltrate the full response content. This issue has been patched in version 0.7.7.

SeverityHigh
CVSS7.5
Exploit probability—
ProductPinchtab
PublishedMar 7, 2026
First seenMar 7, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update
  • pinchtab pinchtab0.7.7 or later
  • github.com/pinchtab/pinchtab/cmd/pinchtab0.7.7 or later
  • github.com/pinchtab/pinchtab0.7.7 or later

Affected products

ProductAffected versionsFixed in
pinchtab pinchtabv < 0.7.70.7.7
github.com/pinchtab/pinchtab/cmd/pinchtabGov < 0.7.70.7.7
github.com/pinchtab/pinchtabGov < 0.7.70.7.7

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.