CVE-2026-91992 in Tornado
Summary
by MITRE • 09/15/2026
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The identified vulnerability resides within Tornado versions prior to 6.5.7, specifically affecting the CurlAsyncHTTPClient implementation which relies on libcurl for asynchronous HTTP operations. The core technical flaw stems from improper state management of pycurl handles during request reuse. In high-throughput environments or long-running services, it is common practice to instantiate a single client object and reuse its underlying connection handles across multiple sequential requests to optimize performance by avoiding the overhead of establishing new connections repeatedly. However, in this specific implementation, when a handle is reused for a subsequent request, critical authentication state from previous interactions is not adequately cleared or reset. This oversight means that sensitive configuration data associated with one request can inadvertently persist and be applied to another unrelated request within the same client instance.
This lack of proper state isolation creates a significant credential leak scenario where an attacker who has control over certain input parameters or can influence the sequence of requests made by the application may exploit this persistence. For instance, if the first request utilizes specific TLS client certificates for mutual authentication or includes proxy credentials in its headers, these sensitive details remain attached to the underlying pycurl handle. When a subsequent request is issued through the same client without explicitly clearing these attributes, those credentials are transmitted alongside the new request data. This allows an attacker to potentially harvest valid TLS certificates or proxy authentication tokens that were intended for different targets or contexts, leading to unauthorized access and potential compromise of downstream systems protected by those credentials.
The operational impact of this vulnerability is severe as it undermines the principle of least privilege and confidentiality in network communications. By obtaining persistent credentials, an adversary can impersonate legitimate services, bypass security controls such as proxy authentication gates, or establish secure tunnels using stolen TLS certificates to exfiltrate data undetected. This type of flaw aligns with CWE-200, which classifies information exposure vulnerabilities where sensitive system information is available to unauthorized actors. Furthermore, the exploitation technique relates to ATT&CK tactic T1539, specifically Steal Web Session Cookies, although in this context it extends beyond cookies to include broader authentication mechanisms like TLS client certs and proxy auth headers. The persistence of state across requests effectively creates a side-channel through which confidential data leaks out of its intended scope.
To mitigate this risk, organizations running Tornado versions earlier than 6.5.7 must upgrade immediately to the patched version where the CurlAsyncHTTPClient has been updated to properly reset or clear authentication-related states between request cycles. Developers should also review their application code for any custom implementations that reuse HTTP client instances and ensure they explicitly manage credential lifecycle, clearing sensitive headers and SSL context attributes before initiating new requests if upgrading is not immediately feasible. Additionally, implementing strict separation of concerns by using distinct client instances for different security contexts can provide an additional layer of defense against state leakage vulnerabilities in asynchronous I/O libraries.