CVE-2026-95625
Received Received - Intake

TLS-Bypassing Update Rollback in Tauri Updater Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: JFrog

Description
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95625
EUVD
EUVD-2026-85170

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tauri updater 2.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-354 The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Tauri updater plugin. The updater fetches an update manifest over TLS but does not verify its authenticity. The manifest contains version, download URL, and signature, but only the binary is signed. An attacker can craft a manifest with a fake version number and force the updater to install an older, signed release without needing the developer's private key.

Detection Guidance

To detect this vulnerability, inspect network traffic for update requests to the Tauri updater endpoint. Check if the update manifest contains a version field that does not match the signed version in the binary. Use tools like Wireshark or curl to fetch the manifest and compare the version field with the signed version in the downloaded artifact.

Impact Analysis

An attacker could trick users into installing an older, potentially vulnerable version of your application. This could lead to security flaws being reintroduced or malicious code being executed if the older version has known weaknesses. Users might unknowingly run outdated software with security issues.

Compliance Impact

This vulnerability could impact compliance with standards like GDPR and HIPAA by enabling unauthorized downgrades of software to older versions. Older versions may lack critical security patches or contain vulnerabilities that violate compliance requirements for data protection and system integrity.

Mitigation Strategies

Enable the `requireSignedVersion` option in the Tauri updater configuration to enforce version matching between the manifest and signed binary. Re-sign and republish older releases if needed. Disable `allowDowngrades` in the plugin configuration to prevent version rollbacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart