MediumVulnerability
CVE-2026-33621: PinchTab rate limiting missing on auth-checkable endpoints
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-33621
- Published
- Record updated
- Affected
- github.com/pinchtab/pinchtab >= 0.7.7, < 0.8.5
- Fixed in
- 0.8.5
- released March 20, 2026, 6 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
PinchTab v0.7.7 through v0.8.4 has incomplete request throttling on auth-checkable endpoints. In v0.7.7 through v0.8.3, RateLimitMiddleware in internal/handlers/middleware.go was never added to the production handler chain, and the pre-v0.8.4 limiter keyed clients by X-Forwarded-For, allowing header spoofing if enabled. v0.8.4 fixed both but still exempted /health and /metrics from rate limiting.
Mitigation
Fixed in v0.8.5: RateLimitMiddleware is applied in the production handler chain, the client address is derived from the immediate peer IP instead of forwarded headers by default, and the /health and /metrics exemption is removed.
Topics
Related items
- MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
- HighGHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processSimilar attack · GitHub Advisory Database
- HighGHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSSimilar attack · GitHub Advisory Database
- HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
- MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database