CVE-2026-116578 in Tornado
Summary
by MITRE • 10/26/2026
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
Tornado, widely recognized as a high-performance Python web framework and asynchronous networking library, contains a critical vulnerability within its URL handling mechanisms prior to version 6.6. The flaw resides specifically in the RedirectHandler component, which processes URL templates containing regex-capture substitutions. These substitutions are designed to dynamically insert values from captured groups into redirect URLs. However, the implementation fails to adequately sanitize or validate these dynamic inputs when they appear at specific positions within the template structure. This oversight allows an attacker who controls part of the request path to manipulate how the browser interprets the resulting redirect destination, effectively bypassing intended security boundaries and leading to a significant open redirect vulnerability.
The technical nature of this flaw involves several distinct attack vectors that exploit how browsers parse different URL formats. When regex-capture substitutions are placed at the start of a path, directly after a fixed host name, or at the very beginning of the template string, they can alter the fundamental structure of the target URL. Attackers can leverage protocol-relative URLs, which omit the scheme and rely on the current page's context; absolute URLs with malicious hosts; backslash-based paths that some browsers interpret as path separators rather than errors; encoded characters that bypass simple validation checks; host-extension techniques where additional domains are appended to a trusted base domain; and user-info variants that embed credentials or trigger authentication prompts. In each of these scenarios, the browser interprets the crafted URL not as a continuation of the original application's context, but as a navigation to an attacker-controlled destination. This behavior is consistent with CWE-601, which defines Open Redirect vulnerabilities where a web application redirects users to URLs provided by external parties without proper validation.
The operational impact of this vulnerability is severe, primarily facilitating phishing attacks against end-users. Because the redirect originates from the legitimate domain of the Tornado-based application, victims are likely to trust the link initially. An attacker can craft a URL that appears to belong to the trusted organization but ultimately redirects the user to a malicious site designed to steal credentials or distribute malware. This undermines the integrity and reputation of the affected service. It is important to note that not all template configurations are vulnerable; static templates without dynamic substitutions, as well as cases where substitutions occur after a fixed host followed by a forward slash, remain unaffected due to stricter parsing rules in those specific contexts. However, given the variability in browser implementations and URL parsing logic, any potential for redirection manipulation poses a substantial risk to application security.
To mitigate this vulnerability, organizations must upgrade their Tornado dependencies to version 6.6 or later, where these input validation checks have been strengthened. For applications that cannot immediately update, developers should implement strict allow-listing of redirect destinations rather than relying on pattern matching alone. Additionally, avoiding the use of regex-capture substitutions in URL templates for redirects is a recommended defensive coding practice. Security teams should also monitor their web application firewalls and intrusion detection systems for patterns associated with open redirect attempts, particularly those involving encoded characters or unusual path structures. This incident aligns with MITRE ATT&CK technique T1566.002, which covers Spearphishing Links, as the vulnerability is frequently weaponized to deliver deceptive links that appear legitimate but lead adversaries to malicious infrastructure.