The Tauri HTTP plugin performs URL validation against a configured scope allowlist only once at the initial request. When a remote server issues an HTTP 3xx redirect, the underlying HTTP client (reqwest) follows the redirect internally without rechecking the new target URL against the allowlist. This behavior allows an attacker controlling an allowed URL or exploiting an open redirect on an allowed host to cause the plugin to send requests to disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts, resulting in a Server-Side Request Forgery (CWE-918).

An attacker can leverage this vulnerability to bypass the URL allowlist restrictions by using HTTP redirects, potentially accessing sensitive internal resources like cloud metadata services or internal network hosts. This could lead to unauthorized information disclosure. The CVSS score of 5.6 indicates a medium impact, with high confidentiality impact but no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider additional controls to restrict redirects or validate URLs after redirects externally. Avoid using the plugin with untrusted URLs or hosts that may perform redirects. Monitor vendor communications for official patches or updates.