---
id: CVE-2026-95623
title: >-
  The Tauri HTTP plugin validates requested URLs against the application's
  configured scope allowlist only once, on the initial request
summary: >-
  The Tauri HTTP plugin validates requested URLs against the application's
  configured scope allowlist only once, on the initial request. When the remote
  server responds with an HTTP 3xx redirect, reqwest follows the redirect
  internally wit…
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
vendor: Tauri
product: tauri-plugin-http
affected:
  - tauri-plugin-http >= 2.0.0 <= 2.6.1
  - tauri-plugin-http >= 2.7.0 <= *
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:34:57.263'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95623'
references:
  - url: 'https://github.com/tauri-apps/plugins-workspace'
    label: reefs@jfrog.com
  - url: >-
      https://github.com/tauri-apps/plugins-workspace/commit/1198a524b710abf2abeb1d9bd7b252402d26ca6d
    label: reefs@jfrog.com
  - url: 'https://github.com/tauri-apps/plugins-workspace/releases/tag/http-v2.7.0'
    label: reefs@jfrog.com
  - url: >-
      https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-2rxp-f4w5-6hjr
    label: reefs@jfrog.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T12:28:50.708719Z'
ingestedAt: '2026-09-22T11:02:22.247Z'
epss: 0.00238
epssPercentile: 0.15152
---

## Overview

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.