Executive brief
PinchTab has SSRF with Full Response Exfiltration via Download Handler in github.com/pinchtab/pinchtab
Affected products
- Go github.com/pinchtab/pinchtab
- Go github.com/pinchtab/pinchtab/cmd/pinchtab
Junglewise Threat Intelligence
CVE-2026-30834: GO-2026-4631 - PinchTab has SSRF with Full Response Exfiltration via Download Handler in github.com/pinchtab/pinchtab
CVE-2026-30834 · Severity: low · CVSS 3.1 · Published 2026-03-10
Technologies: github.com/pinchtab/pinchtab (Go), github.com/pinchtab/pinchtab/cmd/pinchtab (Go). Vendors: Go.
Related threats
- GO-2026-4823 - PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution in github.com/pinchtab/pincht
- GO-2026-4822 - PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems in github.com/pinchtab/pinchtab
- GO-2026-4821 - PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token in github.com/pinchtab/pinchtab
- GO-2026-4824 - A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution in github.com/pinchtab/pinchtab
- PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl