- 5.6MediumCVSS base score
- 0.24%Exploitation in 30 daysEPSS · top 85% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.
Timeline
ID reserved
By JFROG
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| JFROGCNA (assigner) | 3.1 | Medium5.6 | CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
| NVDNVD · Deferred | 3.1 | Medium5.6 | CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.24% · top 85% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.6.
Affected products
- affected 2.0.0 – ≤ 2.6.1
- affected 2.7.0 – ≤ *
What to do
Solution: Upgrade to tauri-plugin-http 2.7.0 or later and turn on the new scopeRedirects option. Both steps are needed. The fix is opt-in, so 2.7.0 on its own still follows a redirect out of scope; the option is what makes the plugin check every hop. Tauri made it opt-in because a redirect that leaves the scope now fails, which changes behaviour for apps that were relying on it. {"plugins": {"http": {"scopeRedirects": true}}} Nothing in the 2.0.0 to 2.6.1 range has a fix available.
References
References4
- GHSA-2rxp-f4w5-6hjr (tauri-apps/plugins-workspace) (opens in a new tab)issue-tracking
- tauri-apps/plugins-workspace repository (opens in a new tab)product
- Check the URL scope on every hop of a redirect chain (opens in a new tab)patch
- tauri-plugin-http 2.7.0 release notes (opens in a new tab)release-notes
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-84351 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-95623)Record last updated .