CVE-2026-95623
Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
- Published
- Updated
- Reserved
- Assigned by
- JFROG
Description
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| JFROGCNA (assigner) | 3.1 | Medium5.6 | CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
| NVDNVD · Deferred | 3.1 | Medium5.6 | CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.24% · top 85% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.6.
Weakness
Affected products
- affected 2.0.0 – ≤ 2.6.1
- affected 2.7.0 – ≤ *
What to do
Solution: Upgrade to tauri-plugin-http 2.7.0 or later and turn on the new scopeRedirects option. Both steps are needed. The fix is opt-in, so 2.7.0 on its own still follows a redirect out of scope; the option is what makes the plugin check every hop. Tauri made it opt-in because a redirect that leaves the scope now fails, which changes behaviour for apps that were relying on it. {"plugins": {"http": {"scopeRedirects": true}}} Nothing in the 2.0.0 to 2.6.1 range has a fix available.
References (4)
- GHSA-2rxp-f4w5-6hjr (tauri-apps/plugins-workspace) (opens in a new tab)issue-tracking
- tauri-apps/plugins-workspace repository (opens in a new tab)product
- Check the URL scope on every hop of a redirect chain (opens in a new tab)patch
- tauri-plugin-http 2.7.0 release notes (opens in a new tab)release-notes
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-95623)Record last updated .