CVE-2026-95625

Executive Summary

CVE-2026-95625 is a signature-integrity flaw in the Tauri updater plugin. The plugin verifies update binaries via minisign signatures, but the signature covers only the raw binary bytes; the update manifest (version number, download URL, signature) is fetched over TLS and is never itself signed or authenticated. An attacker who can serve a crafted manifest — for example via a compromised or impersonated update distribution endpoint — can force installation of any older, validly signed release without holding the developer's private key, defeating the plugin's only anti-rollback control.

Technical Analysis

At its core, this is a trust-boundary error: the secure artifact (the binary) is authenticated, but the metadata that instructs the updater what to install and whether it is permitted is not. Minisign signatures provide authenticity and integrity for the bytes they sign, and Tauri's updater uses them correctly for the binary payload. However, the update manifest — containing the version number, download URL, and signature — is retrieved over TLS but carries no signature or authentication of its own.

The design assumes TLS alone is sufficient to trust the manifest. That assumption fails whenever an attacker can terminate, proxy, or control the TLS connection, or can otherwise inject a manifest. Because the anti-rollback check compares the manifest's version field against the currently installed version, and that field is unsigned, the integrity of the downgrade protection rests entirely on unauthenticated data. CWE-354 (Improper Validation of Integrity Check Value) captures this precisely: an integrity check value (the signature) is applied to the binary but not to the manifest that controls update behavior.

Two properties combine to create the vulnerability. First, the signature is scoped to the raw binary only, not to a canonical representation of the update decision (version plus artifact). Second, the only downgrade defense consumes an unsigned field. An attacker therefore does not need the developer's private key; any previously published, validly signed release in the project's history is sufficient material for the attack. No function names, endpoints, or file paths beyond those in the NVD description are asserted here, as none are provided.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (improper validation of integrity check value) and the NVD description.

1. Reconnaissance / positioning. The attacker identifies a target that relies on the Tauri updater plugin and determines how the update manifest is delivered. Because the manifest is fetched over TLS but unsigned, the attacker needs a position where they can serve a crafted manifest to the victim — through a compromised distribution endpoint, a mis-issued or otherwise controlled TLS certificate, an on-path position that can intercept or redirect the update channel, or any other point at which the manifest response can be substituted.

2. Triggering the flaw class. The attacker crafts a manifest containing a version field set to a value that passes the plugin's anti-rollback comparison, a download URL pointing to an attacker-selected artifact, and a signature that is valid for that artifact. Because the signature covers only raw binary bytes, the attacker may reference any older release that the project previously signed and published — they do not need the developer's private key. The unsigned manifest fields are taken at face value.

3. Payload / execution method (class level). The plugin fetches the referenced binary and verifies its minisign signature. Because the binary is a genuine, previously signed release, verification succeeds, and the updater installs it. No exploit code is executed in the traditional memory-corruption sense; the "payload" is the attacker's choice of a legitimately signed but outdated (and presumably vulnerable) release, delivered under the attacker's control of the manifest.

4. Post-exploitation impact. The victim is silently downgraded to an older, validly signed release. That release may contain subsequent-known vulnerabilities that have since been fixed, and attacker-controlled manifest fields can direct the updater to attacker-chosen download locations. The result is a controlled supply-chain downgrade that rolls back security fixes while preserving signature validity — a high-integrity-impact outcome consistent with the CVSS assessment.

Impact Assessment

Business impact centers on loss of update-integrity assurance for applications built with the Tauri updater plugin. Organizations that ship or consume such applications cannot rely on the updater to enforce anti-rollback, meaning an adversary positioned on the update path can force installation of older signed builds. This can reintroduce previously patched vulnerabilities, undermine patch-management SLAs, and — where the update channel is contractual or regulated — constitute a supply-chain integrity failure.

Blast radius depends on where the vulnerable updater is deployed: desktop applications distributed to end users, internal enterprise tooling, or CI/CD artifact pipelines that consume Tauri builds. Because the manifest controls the download URL, the set of reachable artifacts is effectively attacker-selected among previously signed releases, though the attacker remains constrained to artifacts the project has legitimately signed.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (5.9, Medium) characterizes the impact realistically: the attack vector is network-based (AV:N), but exploitation requires high complexity (AC:H) and high privileges (PR:H) — consistent with needing control of or a position on the update channel. No user interaction (UI:N) and no scope change (S:U) are assessed. Confidentiality and integrity are High (C:H/I:H); availability is None (A:N). CISA KEV status is NO, indicating no confirmed in-the-wild exploitation at time of writing. EPSS has not been scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Tauri Updater Manifest Tampering - Downgrade to Prior Signed Release
id: 7f3a9c21-4b8e-4d6a-9e2f-1c0d5a7b9e34
status: experimental
description: Detects Tauri updater plugin activity consistent with an unsigned manifest forcing installation of an older signed binary (CVE-2026-95625).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95625
author: valtersit.com
date: 2026-01-01
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\app.exe'
      - '\tauri-app.exe'
  selection_cli:
    CommandLine|contains:
      - '--update'
      - 'updater'
      - 'install-update'
  selection_net:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  condition: selection_parent and selection_cli and selection_net
falsepositives:
  - Legitimate application updates via TLS-protected manifest delivery
level: medium
tags:
  - attack.t1195.002

YARA Rule

rule CVE_2026_95625_Tauri_Updater_Manifest_Artifact
{
    meta:
        description = "Detects Tauri updater manifest artifacts with version and signature fields consistent with unsigned-manifest tampering (CVE-2026-95625)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95625"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $manifest_key = "version" ascii wide
        $sig_key      = "signature" ascii wide
        $url_key      = "url" ascii wide
        $platform_key = "platform" ascii wide
        $minisign     = "untrusted comment" ascii
        $pubkey       = "minisign" ascii nocase

    condition:
        filesize < 1MB and
        ($minisign or $pubkey) and
        $manifest_key and
        ($sig_key or $url_key) and
        $platform_key
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-95625 Tauri Updater Manifest Retrieval Over HTTP"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"latest"; nocase; http.uri; content:"json"; nocase; reference:cve,2026-95625; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95625; classtype:policy-violation; sid:2026956; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=60s
  [process where event.type == "start" and process.parent.name : ("app", "tauri-app") and
    process.args : ("*updater*", "*--update*")]
  [network where event.type == "start" and
    network.protocol == "http" and
    process.name : ("app", "tauri-app")]

Splunk SPL Query

index=endpoint OR index=sysmon (EventCode=1 OR EventCode=3)
| eval proc=lower(coalesce(Image, process_name))
| eval cmd=lower(coalesce(CommandLine, process_command_line))
| where (like(proc, "%app.exe%") OR like(proc, "%tauri%"))
    AND (like(cmd, "%updater%") OR like(cmd, "%--update%"))
| join type=left process_guid
    [ search index=endpoint OR index=sysmon EventCode=3
      | eval dest=lower(coalesce(DestinationHostname, destination_hostname))
      | fields process_guid, dest ]
| where isnotnull(dest) AND NOT match(dest, "\.official\.(com|io)$")
| table _time, ComputerName, proc, cmd, dest
| sort - _time

Wazuh OSSEC Rule

<group name="tauri,updater,supply_chain,">
  <rule id="100956" level="8">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">(?i)(app|tauri-app)\.exe$</field>
    <field name="win.eventdata.commandLine">(?i)(updater|--update)</field>
    <description>CVE-2026-95625: Tauri updater invoked; verify manifest delivery is TLS-protected and from an authoritative source.</description>
    <mitre>
      <id>T1195.002</id>
    </mitre>
    <group>supply_chain,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Enforce TLS certificate pinning or strict validation on the update manifest fetch path where the updater permits configuration.
   • Restrict egress from update clients to known, authoritative update hosts, and block plaintext or unexpected manifest endpoints.
   • Where feasible, disable automatic updates until a signed-manifest capability is available, and perform updates out-of-band over a controlled channel.
   • Monitor for downgrade events: compare installed versions against the expected current release and alert on unexpected regressions to older signed builds.

2. Patch / upgrade steps.

   • No vendor patch is currently identified; track the Tauri project's advisories and release notes for a version that signs/authenticates the update manifest (including the version and download URL fields) rather than relying on TLS alone.
   • When a fixed release is published, upgrade the updater plugin and, critically, re-baseline clients — because a client already downgraded by this flaw may not self-recover through the same update path.

3. Long-term hardening.

   • Require that update metadata (version, URL, artifact hash) be covered by the same signature that protects the binary, so anti-rollback decisions consume authenticated data.
   • Adopt signed manifests and, where possible, reproducible-build attestations and transparency-log style records for update artifacts.
   • Treat update channels as high-value supply-chain assets: enforce least privilege on distribution endpoints, log and alert on manifest changes, and test downgrade-resistance as part of release validation.

References

• NVD — CVE-2026-95625: https://nvd.nist.gov/vuln/detail/CVE-2026-95625
• CWE-354 — Improper Validation of Integrity Check Value: https://cwe.mitre.org/data/definitions/354.html
• MITRE ATT&CK T1195.002 — Compromise Software Supply Chain: https://attack.mitre.org/techniques/T1195/002/
• CISA Known Exploited Vulnerabilities Catalog (status: NO): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-95625 at time of writing. No public PoC, Nuclei template, or exploit code was observed. CISA KEV status is NO.