Live › vulnerability › CVE-2026-116578
Go to dashboardTornado's RedirectHandler can be given URL templates with regex-capture substitutions in positions that let a crafted request path change the redirect scheme or host. An attacker gets an open redirect on the application's own domain, usable for phishing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Applications that use tornado.web.RedirectHandler with a URL template where a regex capture group sits at the start of the template, directly after a fixed host, or at the start of a path. Static redirect templates and templates with a slash after the fixed host are not affected.
No product ranges from the sources yet.
pip show tornado or python -c "import tornado; print(tornado.version)" to read the installed versionRedirectHandler and check whether any URL template starts with a regex capture group, or places one directly after a fixed host6.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-116578")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.