CVE-2026-33081: Pinchtab SSRF Vulnerability via /download

CVE-2026-33081 Overview

CVE-2026-33081 is a Blind Server-Side Request Forgery (SSRF) vulnerability affecting PinchTab, a standalone HTTP server designed to give AI agents direct control over a Chrome browser. The vulnerability exists in the /download endpoint where the validateDownloadURL() function only validates the initial user-supplied URL, but the embedded Chromium browser can follow attacker-controlled redirects or navigations to internal network addresses after validation has completed.

Critical Impact

An attacker-controlled page can leverage JavaScript redirects or resource requests to make the browser reach internal services from the PinchTab host, enabling blind SSRF attacks against internal-only services. Exploitation requires security.allowDownload=true (disabled by default), which limits real-world impact.

Affected Products

• PinchTab versions 0.8.2 and below
• PinchTab HTTP server with security.allowDownload=true configuration enabled

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-33081 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33081

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The core issue stems from a Time-of-Check Time-of-Use (TOCTOU) race condition in the URL validation logic. When a download request is submitted to the /download endpoint, the validateDownloadURL() function performs security checks on the provided URL to prevent access to internal network resources. However, this validation only occurs at the initial request time.

The embedded Chromium browser subsequently processes the validated URL, but because the browser follows HTTP redirects and executes JavaScript, an attacker can construct a malicious page that initially passes validation but then redirects to internal network addresses (such as 127.0.0.1, localhost, or private IP ranges like 10.x.x.x, 192.168.x.x, or 172.16.x.x).

This is a "blind" SSRF because the attacker typically cannot see the response from internal services, but can still trigger requests that may have side effects on internal infrastructure.

Root Cause

The root cause is insufficient validation of URL destinations after the initial security check. The validateDownloadURL() function validates only the user-supplied URL at request time, but fails to enforce validation on subsequent navigations or redirects performed by the Chromium browser. This allows attackers to bypass URL restrictions through multi-stage redirects or JavaScript-based navigation that occurs after the initial validation completes.

Attack Vector

The attack requires network access to the PinchTab server and the security.allowDownload=true configuration to be enabled. An attacker constructs a malicious external webpage that:

1. Presents an innocuous URL that passes the validateDownloadURL() check
2. Uses HTTP redirects (301/302/307/308) or JavaScript (window.location, meta refresh, etc.) to navigate to internal network addresses
3. Makes requests to internal services from the context of the PinchTab host

Since this is a blind SSRF, the attacker cannot directly retrieve response data, but can potentially interact with internal APIs, trigger administrative actions, or probe for internal service existence through timing-based side channels.

Detection Methods for CVE-2026-33081

Indicators of Compromise

• Unusual outbound requests from PinchTab server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8)
• HTTP requests to the /download endpoint followed by connections to unexpected internal services
• Access logs showing requests to external URLs known to host redirect chains

Detection Strategies

• Monitor network traffic from the PinchTab host for connections to internal network addresses that were not initiated by legitimate application functions
• Implement logging on the /download endpoint to capture all requested URLs and correlate with subsequent network activity
• Deploy network segmentation monitoring to alert on unexpected cross-segment communication from the PinchTab server

Monitoring Recommendations

• Enable verbose logging for the PinchTab server to track all download requests and their final destinations
• Configure egress filtering alerts for the PinchTab host to detect connections to internal service ports
• Review access logs for patterns of external URL requests that may indicate reconnaissance or exploitation attempts

How to Mitigate CVE-2026-33081

Immediate Actions Required

• Upgrade PinchTab to version 0.8.3 or later, which contains the security patch for this vulnerability
• Verify that security.allowDownload is set to false (the default) unless absolutely required for your use case
• If download functionality is required, implement network-level controls to restrict outbound connections from the PinchTab host

Patch Information

The vulnerability has been patched in PinchTab version 0.8.3. The fix addresses the TOCTOU issue by implementing validation checks that persist throughout the download process, including redirect following. Users should upgrade immediately by obtaining the patched version from the GitHub Release v0.8.3. Additional details about the vulnerability can be found in the GitHub Security Advisory GHSA-qwxp-6qf9-wr4m.

Workarounds

• Disable the download feature by ensuring security.allowDownload=false in your PinchTab configuration
• Implement network-level egress filtering to prevent the PinchTab host from initiating connections to internal network ranges
• Deploy a web application firewall (WAF) or reverse proxy in front of PinchTab to inspect and block suspicious redirect chains

# Configuration example
# Ensure download functionality is disabled in PinchTab configuration
# Set security.allowDownload to false (default setting)
security.allowDownload=false

# Implement network-level egress rules to block internal IP access
# Example iptables rules to prevent SSRF to internal networks
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner pinchtab -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner pinchtab -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner pinchtab -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner pinchtab -j DROP