PT-2026-27628 · Pinchtab · Pinchtab

Published 2026-03-24 · Updated 2026-03-27 · CVE-2026-33621

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PinchTab versions v0.7.7 through v0.8.4

Description PinchTab, a standalone HTTP server designed to give AI agents control over a Chrome browser, has incomplete request-throttling protections for endpoints requiring authentication checks. In versions v0.7.7 through v0.8.3, a fully implemented RateLimitMiddleware existed but was not integrated into the production HTTP handler chain, meaning requests were not subject to the intended per-IP rate limiting. Within the same range (v0.7.7 through v0.8.3), the original limiter used the X-Forwarded-For header to identify clients, which could be exploited through client-controlled header spoofing if the middleware had been enabled. Version v0.8.4 addressed these two issues by incorporating the limiter into the handler chain and switching to the immediate peer IP for identification, but it continued to exempt the /health and /metrics endpoints from rate limiting, despite /health being an auth-checkable endpoint when a token was configured. This weakens the overall security of deployments where the API is accessible, particularly if a weak, human-chosen token is used. The issue does not directly bypass authentication or disclose tokens. The default deployment model of PinchTab is local-first, using 127.0.0.1 and a generated random token, which reduces the practical risk in standard configurations. The issue was fully resolved in version v0.8.5 by applying the RateLimitMiddleware in the production handler chain, deriving the client address from the immediate peer IP, and removing the exemptions for /health and /metrics, ensuring that all auth-checkable endpoints are throttled. The /health API endpoint is an example of an API endpoint. The RateLimitMiddleware is a function that was not initially applied.

Recommendations PinchTab versions v0.7.7 through v0.8.4 are affected and should be updated to version v0.8.5 or later.

Exploit

Fix

Allocation of Resources Without Limits

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-770

CWE-290

Related Identifiers

CVE-2026-33621

GHSA-J65M-HV65-R264

GO-2026-4821

SUSE-SU-2026:1135-1

Affected Products

Pinchtab

References · 150

• 🔥 https://github.com/pinchtab/pinchtab/security/advisories/GHSA-j65m-hv65-r264 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33621.json · Exploit
• https://github.com/pinchtab/pinchtab/commit/c619c43a4f29d1d1a481e859c193baf78e0d648b · Patch
• https://osv.dev/vulnerability/GHSA-j65m-hv65-r264 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33621 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33621 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4821 · Vendor Advisory
• https://github.com/pinchtab/pinchtab · Note
• https://github.com/pinchtab/pinchtab/releases/tag/v0.8.4 · Note
• https://suse.com/security/cve/CVE-2026-32811 · Note
• https://suse.com/security/cve/CVE-2026-4342 · Note
• https://suse.com/security/cve/CVE-2019-8400 · Note
• https://suse.com/security/cve/CVE-2026-33529 · Note
• https://suse.com/security/cve/CVE-2026-2457 · Note