CVE-2026-33620: PinchTab accepts API token in URL query parameter

Summary

PinchTab, a standalone HTTP server giving AI agents direct control over a Chrome browser, versions v0.7.8 through v0.8.3 accepted the API token from a `token` URL query parameter as well as the `Authorization` header. A valid credential sent in the URL can be exposed through URIs recorded by reverse proxy access logs, browser and shell history, clipboard history, and tracing systems. The issue is an unsafe credential transport pattern rather than an authentication bypass, and it affects only deployments with a configured token where a client uses the query-parameter form.

Mitigation

Fixed in v0.8.4, which removes query-string token authentication and requires safer header- or session-based authentication flows.

Topics

• AI agents

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News