Executive brief
The Tauri HTTP plugin, used by desktop applications to make web requests, validates URLs against a configured allowlist only on the initial request. When a remote server issues an HTTP redirect, the plugin follows it without re-validating the destination, allowing attackers to reach restricted endpoints like cloud metadata services or internal servers that should be off-limits.
Technical details
The vulnerability is a scope validation bypass in the Tauri HTTP plugin where reqwest follows HTTP 3xx redirects internally without re-checking the new target URL against the application's configured scope allowlist. An attacker with control of an allowed URL or access to an open redirect on an allowed host can reach disallowed destinations such as cloud metadata endpoints (169.254.169.254), localhost services, or internal network hosts that the application should not be able to access.
Affected products
- Tauri HTTP plugin <UNKNOWN>
Timeline
- 2026-09-22: disclosed