CVE-2026-95623

Name of the Vulnerable Software and Affected Versions Tauri HTTP plugin (affected versions not specified)

Description The HTTP plugin validates requested URLs against the application's configured scope allowlist only during the initial request. If the remote server returns an HTTP 3xx redirect, the internal reqwest library follows the redirect without re-validating the new target URL against the scope. This behavior enables an attacker who controls an allowed URL, or leverages an open redirect on an allowed host, to access restricted destinations, including localhost services, internal network hosts, or cloud metadata endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.