Go/github.com/pinchtab/pinchtab CVE-2026-33619: medium 4.1, EPSS 0.26%

PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl

Action: Upgrade github.com/pinchtab/pinchtab to 0.8.4 or later.

go get github.com/pinchtab/pinchtab@v0.8.4

Affected

Fixed versions

Sources

• osv: GHSA-xqq2-4j46-vwp7
• https://github.com/pinchtab/pinchtab/security/advisories/GHSA-xqq2-4j46-vwp7
• https://nvd.nist.gov/vuln/detail/CVE-2026-33619
• https://github.com/pinchtab/pinchtab/commit/c824574c3a05073dec2f5e9c219e22ffff8de445
• https://github.com/pinchtab/pinchtab
• https://github.com/pinchtab/pinchtab/releases/tag/v0.8.4

CVE-2026-33619 · published 2026-03-24T19:32:21Z · modified 2026-05-05T15:58:52.103044Z · JSON