CVE-2026-95624

Executive Summary

CVE-2026-95624 is an improper access control flaw (CWE-284) in the Tauri updater plugin, where the check IPC command accepts an allowDowngrades boolean supplied directly by frontend JavaScript. When that flag is set to true, the version comparator is changed from "update must be newer" to "update must be different," disabling the updater's sole anti-rollback protection. Any application built on the affected Tauri updater plugin is impacted, and because the default permission set grants allow-check to the webview, any XSS in the app frontend is sufficient to reach the vulnerable command. The CVSS base score is 6.8 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), with full loss of confidentiality and integrity to the affected application but no direct availability impact.

Technical Analysis

The vulnerability resides at the trust boundary between a Tauri webview (untrusted frontend) and the native Rust backend that performs update checks. Tauri's security model relies on an IPC command allowlist and per-command permission scopes. The updater plugin exposes a check IPC command and, per the description, ships with a default permission set that grants allow-check to the webview. That default is what makes the command reachable from frontend JavaScript without any elevated capability being granted by the developer.

The core defect is that check accepts an allowDowngrades boolean parameter that originates from frontend JavaScript rather than from a server-controlled or backend-controlled trust source. The parameter is therefore fully attacker-controllable whenever an attacker has script execution inside the webview. The semantics of the flag are the critical detail: setting it to true switches the version comparator from "update must be newer than the installed version" to "update must be different from the installed version." The comparison basis itself is being altered by untrusted input.

That change removes the only anti-rollback control the updater offers. A downgrade attack — delivering an older, known-vulnerable release in place of the current one — is normally blocked because the older version fails the "must be newer" test. Under the modified comparator, any version that differs passes, so an attacker no longer needs to forge a higher version number. The description specifically notes that combined with another bug, downgrades become possible "without even needing to fake a higher version number," meaning a second defect is required to complete the downgrade delivery path (for example, to satisfy whatever artifact or signature constraint remains). The vulnerability class is improper access control / privilege boundary violation: an authorization decision (which version is acceptable) is delegated to an untrusted caller.

Two design weaknesses compound each other. First, the allow-check permission is granted to the webview by default, so no developer misconfiguration is needed to expose the command. Second, the security-relevant allowDowngrades decision is a caller-supplied parameter rather than a fixed backend policy. Neither the NVD description nor the CNA data discloses specific signatures, endpoint URLs, or manifest fields beyond the command and parameter names above; no further implementation detail is asserted here.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this CVE. The attack chain below is inferred strictly from the vulnerability class described in the advisory and does not rely on any function, path, or parameter not named in the source text.

1. Reconnaissance / target identification. The attacker identifies a desktop application built on the affected Tauri updater plugin whose frontend (webview) renders attacker-influenceable content — remote content, a web-based component, or any surface where script injection is possible. The reconnaissance prerequisite is the presence of a frontend XSS foothold, since the check command is only reachable from JavaScript running inside the webview.

2. Triggering the flaw. The precondition is JavaScript execution in the webview. From that context, the attacker invokes the check IPC command with allowDowngrades set to true. Because the default permission set grants allow-check to the webview, the call is accepted under the default configuration and no additional capability grant is required. This is the privilege boundary violation: authorization over downgrade acceptance is taken by the caller itself.

3. Payload / execution method. With the comparator switched from "must be newer" to "must be different," the attacker directs the updater at an older, vulnerable release. The advisory states that a second bug is required in combination so that the downgrade completes "without even needing to fake a higher version number" — i.e., the companion defect handles the artifact/version constraint that would otherwise still block delivery. This report does not speculate on the mechanics of that second bug; it is not described in the available data.

4. Post-exploitation impact. The application installs and runs an older release that predates security fixes. The attacker effectively re-exposes the endpoint to every vulnerability the application has already patched, providing a reliable route to re-establish a foothold after remediation and a downgrade-based persistence mechanism. Per the CVSS subscores, impact is complete loss of confidentiality and integrity (C:H/I:H) to the affected component with no availability impact (A:N); the UI:R vector reflects that user interaction (running the app with the injected frontend) is required, and AC:H reflects the dependency on both an XSS foothold and the companion bug.

Impact Assessment

The blast radius is any application that ships the affected Tauri updater plugin with the default permission set — a broad population of desktop apps that use Tauri for auto-updating. These are typically endpoint-resident, user-context applications on developer workstations and corporate endpoints rather than internet-facing servers, so an exploited instance grants the attacker code execution in the same security context as the user.

Business impact centers on remediation regression and persistence. An attacker with a webview XSS foothold can silently roll the application back to a release with known, possibly remotely exploitable, vulnerabilities — a classic downgrade attack that defeats the patch treadmill. This can be chained into ransomware staging, credential theft, or lateral movement via an application that is trusted and allowlisted on the endpoint. Confidentiality and integrity impact is rated High for the affected component (C:H/I:H), while availability impact is None (A:N) — the application remains functional; it is simply running attacker-selected, older code. The overall score of 6.8 is Medium severity, tempered by the High attack complexity and required user interaction, but the integrity consequences are as severe as any full code-execution-by-proxy scenario because the attacker controls which historical build (and therefore which known CVEs) is reinstalled.

Note: EPSS has not yet been scored by FIRST.org for this CVE; no EPSS probability is asserted. The CVE is not listed in CISA KEV, and no evidence of in-the-wild exploitation or named threat actor campaign is available.

Detection Guidance

Detection is challenging because the vulnerable check invocation is an in-process IPC call rather than network traffic. The strongest signals are at the host and application-log layer: anomalous update-check calls carrying allowDowngrades set to true, and actual version regressions on updated hosts. Network-layer rules are best-effort heuristics for the download of markedly older release artifacts.

Sigma Rule

title: Tauri Updater check IPC Invoked With allowDowngrades=true
id: 7f2a1c94-3b6e-4c1a-9d2f-5a8e0c11d3b7
status: experimental
description: Detects invocation of the Tauri updater check IPC command carrying the allowDowngrades parameter set to true, which disables anti-rollback protection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95624
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1195
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'allowDowngrades'
  selection_true:
    CommandLine|contains:
      - 'allowDowngrades":true'
      - 'allowDowngrades=true'
      - "'allowDowngrades': true"
      - '"allowDowngrades": true'
  condition: selection_cmd and selection_true
falsepositives:
  - Legitimate administrative rollback tooling
  - Developer testing of the updater plugin
level: high

YARA Rule

rule CVE_2026_95624_Tauri_AllowDowngrades
{
    meta:
        description = "Detects Tauri frontend bundles or logs referencing the allowDowngrades parameter of the updater check IPC command"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95624"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ipc1 = "allowDowngrades" ascii wide
        $ipc2 = "allow-check" ascii wide
        $ipc3 = "allowCheck" ascii wide
        $tauri1 = "__TAURI__" ascii wide
        $tauri2 = "tauri" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or filesize < 5MB) and
        any of ($ipc*) and any of ($tauri*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-95624 Tauri Updater Downgrade Artifact Request"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"latest.json"; nocase; http.header; content:"User-Agent"; content:"tauri"; nocase; threshold:type limit, track by_src, count 2, seconds 300; reference:cve,2026-95624; classtype:trojan-activity; sid:2026956240; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.command_line != null and
  process.command_line : "*allowDowngrades*" and
  (process.command_line : "*true*" or process.command_line : "*:true*" or process.command_line : "*=true*")

Splunk SPL Query

index=endpoint OR index=applogs (source="*tauri*" OR source="*updater*")
| eval dow = if(match(_raw, "allowDowngrades[\"']?\s*[:=]\s*true"), 1, 0)
| where dow=1
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="tauri,updater,CVE-2026-95624,">
  <rule id="100624" level="12">
    <decoded_as>json</decoded_as>
    <field name="command">\.*allowDowngrades</field>
    <description>CVE-2026-95624: Tauri updater check invoked with allowDowngrades parameter</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
  <rule id="100625" level="13">
    <if_sid>100624</if_sid>
    <match>true</match>
    <description>CVE-2026-95624: allowDowngrades set to TRUE - anti-rollback protection bypassed</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented in the available data; the measures below are defensive recommendations appropriate to the vulnerability class.

1. Immediate mitigations

• Eliminate frontend XSS: enforce a strict Content-Security-Policy on the webview, avoid loading remote or attacker-influenceable content, and validate/sanitize all rendered data. Since the default permission set grants allow-check to the webview, the XSS foothold is the gate that must be closed.
• Remove the allow-check permission from the webview's default capability set where the update check does not need to be initiated from the frontend, and move update checks to the native backend.
• Treat allowDowngrades as a backend-controlled, non-frontend-settable policy. Do not accept it from IPC input.

2. Patch / upgrade steps

• Monitor the Tauri updater plugin project for an official advisory and patched release. No fixed version is currently identified (affected version range unknown). Until a patch is published, prioritize the mitigations above.
• If a patched version becomes available, upgrade the updater plugin and rebuild all affected applications; verify that the new default permission set no longer exposes allow-check to untrusted webview content.

3. Long-term hardening

• Enforce a defense-in-depth update model: signed release manifests verified against a backend-owned trust root, with version monotonicity enforced server-side and re-checked in the native layer so frontend input can never relax the comparator.
• Maintain a per-command capability review so that security-critical IPC parameters are never sourced from the webview.
• Log and alert on version regressions (an application reporting a lower version after an update cycle) and on any update-check call carrying allowDowngrades, using the detection content above.

References

• NVD — CVE-2026-95624: https://nvd.nist.gov/vuln/detail/CVE-2026-95624
• Tauri updater plugin documentation (IPC command and capability model): https://v2.tauri.app/plugin/updater/
• CWE-284: Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• CISA Known Exploited Vulnerabilities Catalog (verify CVE-2026-95624 status; not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score pending as of this report): https://www.first.org/epss/

No public PoC, exploit code, Nuclei template, or in-the-wild exploitation evidence is available for CVE-2026-95624. No named threat actor campaign has been associated with this CVE.