CVE-2026-95623 json
Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
published 2026-09-22 47 d ago modified 2026-09-22 47 d ago also EUVD-2026-84351
- cvss
- 5.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 47 d ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.6 | CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
Affected products
- Tauri tauri-plugin-http
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/tauri-apps/plugins-workspace/commit/1198a524b710abf2abeb1d9bd7b252402d26ca6d
patch
-
github.com
/tauri-apps/plugins-workspace/security/advisories/GHSA-2rxp-f4w5-6hjr
issue-tracking
-
github.com
/tauri-apps/plugins-workspace
product
-
github.com
/tauri-apps/plugins-workspace/releases/tag/http-v2.7.0
release-notes
Sources
- CVE List CVE-2026-95623
- NVD CVE-2026-95623
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.