Tornadoweb Tornado up to 6.5 Redirect tornado/web.py tornado.web.RedirectHandler redirect

Summaryinfo

A vulnerability described as problematic has been identified in Tornadoweb Tornado up to 6.5. Affected by this vulnerability is the function tornado.web.RedirectHandler of the file tornado/web.py of the component Redirect Handler. Executing a manipulation can lead to redirect. The identification of this vulnerability is CVE-2026-116578. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in Tornadoweb Tornado up to 6.5. This vulnerability affects the function tornado.web.RedirectHandler of the file tornado/web.py of the component Redirect Handler. The manipulation with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. As an impact it is known to affect integrity. CVE summarizes:

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-116578 since 10/26/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1204.001.

Upgrading to version 6.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Tornadoweb

Name

• Tornado

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5

Website

• Product: https://github.com/tornadoweb/tornado/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion