CVE-2026-95623

What it is

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.

At a glance

Exploitability

Can be exploited from the same network segment without logging in, but needs a user to act. High risk of data exposure.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-22 11:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-22 19:34 UTC Last updatedMost recent change to the record

Details

Published

2026-09-22 11:17 UTC

Last modified

2026-09-22 19:34 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-918 · Server-side request forgery

Record status

Deferred

Attack profile CVSS 3.1 · 5.6

Attack vector

Adjacent network

Complexity

High

Privileges needed

None

User interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None