CVE-2026-95625 Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade
Attackers can force installation of older, vulnerable application versions by serving unsigned update manifests, bypassing anti-rollback protections in the Tauri updater.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-95625?
CVE-2026-95625 is a medium-severity vulnerability in tauri-plugin-updater, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.
Weakness: CWE-354
Which versions are affected by CVE-2026-95625?
How do I fix CVE-2026-95625?
No fix has been published for CVE-2026-95625 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-95625 being exploited?
There is no known exploitation of CVE-2026-95625 in the wild and no public exploit code.
Sources
Also known as GHSA-j38x-g3m3-95fr, GHSA-p8c6-29q6-cqw7, UBUNTU-CVE-2026-95625.