PinchTab には、github.com/pinchtab/pinchtab のダウンロードハンドラを介した完全なレスポンスの外部への漏洩を伴う SSRF が存在します。

The SSRF vulnerability in PinchTab allows an attacker to craft malicious requests that the application forwards to internal or external resources. Because the download handler allows full response exfiltration, an attacker could potentially retrieve sensitive data from internal services or external websites that PinchTab is configured to access. This could include API keys, database credentials, or other confidential information. The blast radius extends to any resources accessible by the PinchTab instance, potentially impacting internal network services and external data sources.

Organizations deploying PinchTab in environments with access to sensitive internal resources or external APIs are at risk. Specifically, those using PinchTab as a proxy or gateway for accessing internal services are particularly vulnerable, as the SSRF vulnerability could be leveraged to bypass access controls and retrieve confidential data.

• go / application: Inspect PinchTab configuration files for any unusual or unexpected URLs in the download handler.

grep -r 'download_url' /path/to/pinchtab/config/*.yaml

• generic web: Monitor access logs for unusual outbound requests originating from the PinchTab server. Look for requests to internal IP addresses or unexpected domains.

curl -v <pinchtab_url>/download?url=<suspicious_url>

1. 2026-03-10Disclosure

   disclosure

1. 予約済み2026-03-05
2. 公開日2026-03-10
3. 更新日2026-03-23
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-30834 is to upgrade PinchTab to version 0.7.7 or later, which includes the fix for the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block suspicious outbound requests. Restrict network access to the PinchTab instance to only necessary resources. Thoroughly review and validate any external URLs used by the download handler to prevent unintended access to sensitive data. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a known malicious URL and verifying that the request is blocked or handled securely.