CVE-2026-33620

Pinchtab 0.7.8 – 0.8.4

Public PoC

Published

26 March 2026

Modified

31 March 2026

Patch / advisory

View advisory

CVSS Score v3.1 4.3

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS Score 0.0027 19th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-33620 is a medium-severity Use of HTTP Request With Sensitive Query String (CWE-598) vulnerability in Pinchtab Pinchtab. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Privacy and Disclosure risk domain.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-16401

Vulnerability Data

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.8` through `v0.8.3` accepted the API token from a `token` URL query parameter in addition to the `Authorization` header. When a valid API…

credential is sent in the URL, it can be exposed through request URIs recorded by intermediaries or client-side tooling, such as reverse proxy access logs, browser history, shell history, clipboard history, and tracing systems that capture full URLs. This issue is an unsafe credential transport pattern rather than a direct authentication bypass. It only affects deployments where a token is configured and a client actually uses the query-parameter form. PinchTab's security guidance already recommended `Authorization: Bearer <token>`, but `v0.8.3` still accepted `?token=` and included first-party flows that generated and consumed URLs containing the token. This was addressed in v0.8.4 by removing query-string token authentication and requiring safer header- or session-based authentication flows.

CWE(s): CWE-598

AI Security AnalysisAI

AI Category: AI Agent Protocols and Integrations
Risk Domain: Privacy and Disclosure
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: Matched keywords: ai

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552 Unsecured Credentials Credential Access

Adversaries may search compromised systems to find and obtain insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Vulnerability exposes API tokens in URLs/logs/history (CWE-598), directly facilitating discovery of unsecured credentials.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-33623Same product: Pinchtab Pinchtab

CVE-2026-33621Same product: Pinchtab Pinchtab

CVE-2026-33619Same product: Pinchtab Pinchtab

CVE-2026-30834Same product: Pinchtab Pinchtab

CVE-2026-33622Same product: Pinchtab Pinchtab

CVE-2026-33081Same product: Pinchtab Pinchtab

CVE-2026-16207Shared CWE-598

CVE-2026-15322Shared CWE-598

CVE-2026-26196Shared CWE-598

CVE-2025-13219Shared CWE-598

Affected Assets

pinchtab

0.7.8 — 0.8.4

Mitigating Controls

Control response

Prevent

Stop it (NIST 800-53)

IA-5 Authenticator Management
SC-8 Transmission Confidentiality and Integrity
SC-23 Session Authenticity

Detect

Catch it (NIST detect / respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V3.4.5
V14.2.1

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management good match

prevent

Requires secure management and transmission of authenticators, directly prohibiting exposure of tokens via query parameters in URLs.

SC-8 Transmission Confidentiality and Integrity good match

prevent

Mandates cryptographic protection and confidentiality mechanisms for sensitive data such as credentials during transmission, eliminating unsafe query-string transport.

SC-23 Session Authenticity partial match

prevent

Enforces session authenticity through secure mechanisms (headers or established sessions) rather than embedding credentials in request URIs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match

prevents

Secure SDLC practices directly prevent embedding sensitive data in query strings as part of input-handling and data-flow design.

PR.DS-02 partial match

prevents

HTTPS encryption protects query strings in transit but does not address the root design flaw of placing sensitive data in URLs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match

detects

Security testing can detect sensitive data leakage via query strings.

A.8.12 Data leakage prevention partial match

mitigates

DLP solutions can detect and block sensitive data in URLs.

A.8.20 Networks security partial match

degrades

Network security controls can enforce HTTPS and block sensitive data in URLs.

A.8.26 Application security requirements partial match

prevents

Application security requirements should mandate avoiding sensitive data in query strings.