« Volver al listado

CVE-2026-95623

Estado: AplazadaMedia (5.6)—

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Requiere interacción del usuario (UI:R) para iniciar la solicitud HTTP. La vulnerabilidad de redirección permite eludir validación de scope y acceder a servicios restringidos (SSRF/proxy) o exfiltrar datos de metadata endpoints internos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network Intrusion PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareData Loss Prevention

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Reqwest — ReqwestAITauri — Http PluginAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-95623",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-95623",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-22T12:28:50.708719Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "reefs@jfrog.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.6,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "reefs@jfrog.com",
      "affectedData": [
        {
          "repo": "git://github.com/tauri-apps/plugins-workspace",
          "vendor": "Tauri",
          "product": "tauri-plugin-http",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.6.1"
            },
            {
              "status": "affected",
              "version": "2.7.0",
              "versionType": "semver",
              "lessThanOrEqual": "*"
            }
          ],
          "packageName": "tauri-plugin-http",
          "programFiles": [
            "plugins/http/src/commands.rs",
            "plugins/http/src/scope.rs",
            "plugins/http/src/config.rs"
          ],
          "collectionURL": "https://crates.io/crates/tauri-plugin-http",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-22T11:17:27.357",
  "references": [
    {
      "url": "https://github.com/tauri-apps/plugins-workspace",
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://github.com/tauri-apps/plugins-workspace/commit/1198a524b710abf2abeb1d9bd7b252402d26ca6d",
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://github.com/tauri-apps/plugins-workspace/releases/tag/http-v2.7.0",
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-2rxp-f4w5-6hjr",
      "source": "reefs@jfrog.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "reefs@jfrog.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts."
    }
  ],
  "lastModified": "2026-09-22T19:34:57.263",
  "sourceIdentifier": "reefs@jfrog.com"
}