{"id":"CVE-2026-126347","kind":"vulnerability","aliases":["CVE-2026-126347"],"related":[],"title":"Tornado: crafted redirect paths send users to attacker-controlled hosts","description":"Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using  tornado.web.RedirectHandler  with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1.","summary":"Tornado's RedirectHandler can be tricked into sending a user to an attacker's site when a URL template lets attacker input shape the destination, using three or more leading slashes. Python and browsers parse such URLs differently, so the crafted destination reaches an outside host.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","python","tornado","web-apps"],"not_affected_if":["static-redirect-targets","tornado-6.6.1-or-later"],"how_to_check":"- Check the installed Tornado version with `python -c \"import tornado; print(tornado.version)\"`\n- Search the code for `RedirectHandler` and look for redirect URLs built from user-supplied values","fix":"- Tornado: upgrade to `6.6.1`","status":"open","published_at":"2026-11-12T22:19:19+00:00","first_seen_at":"2026-11-12T22:40:37+00:00","triaged_at":"2026-11-12T22:42:35+00:00","updated_at":"2026-11-12T22:42:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T22:42:35Z","model":"claude-haiku-5-5","output":{"fix":"- Tornado: upgrade to `6.6.1`","reach":"internet","title":"Tornado: crafted redirect paths send users to attacker-controlled hosts","impact":"low","summary":"Tornado's RedirectHandler can be tricked into sending a user to an attacker's site when a URL template lets attacker input shape the destination, using three or more leading slashes. Python and browsers parse such URLs differently, so the crafted destination reaches an outside host.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","tornado","web-apps"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"users are redirected to attacker-controlled phishing sites","analyst_note":"","how_to_check":"- Check the installed Tornado version with `python -c \"import tornado; print(tornado.version)\"`\n- Search the code for `RedirectHandler` and look for redirect URLs built from user-supplied values","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["static-redirect-targets","tornado-6.6.1-or-later"],"who_is_affected":"Applications that use tornado.web.RedirectHandler with URL templates where attacker-controlled input can influence the redirect destination. Applications that only use fixed redirect targets are not exposed. The advisory describes versions through 6.6.0 as affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000722,"input_tokens":4656,"output_tokens":512,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116578':142C '-126347':14A,17A '-2026':13A,16A,141C '6.6.0':83C,145C '6.6.1':158C 'address':149C 'allow':91C,123C 'app':23B 'applic':84C 'asynchron':77C 'attack':9A,36B,44B,93C,134C 'attacker-control':8A,92C,133C 'browser':57B,120C 'case':151C 'control':10A,94C,135C 'craft':2A,64B,125C 'cve':12A,15A,140C 'destin':48B,65B,99C,126C 'differ':61B,113C 'fix':155C 'framework':75C 'fulli':148C 'host':11A,69B,136C 'influenc':97C 'input':45B 'interpret':122C 'issu':153C 'lead':53B,111C 'let':43B 'librari':79C 'network':78C 'open':105C 'outsid':68B 'packag':18B 'pars':58B,118C 'path':4A 'python':19B,55B,73C,115C 'reach':66B 'redirect':3A,106C,128C 'redirecthandl':26B 'remedi':138C 'send':5A,31B 'shape':46B 'site':38B 'slash':54B,112C 'substitut':95C 'templat':42B,89C 'three':50B,108C 'tornado':1A,20B,24B,70C 'tornado.web.redirecthandler':86C 'trick':29B 'url':41B,60B,88C,117C,121C 'use':49B,85C,107C 'user':6A,33B,130C 'version':81C,144C,157C 'vulner':102C 'web':22B,74C 'web-app':21B","nicknames":[],"mitigations":[],"who_affected":"Applications that use tornado.web.RedirectHandler with URL templates where attacker-controlled input can influence the redirect destination. Applications that only use fixed redirect targets are not exposed. The advisory describes versions through 6.6.0 as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","package","python","tornado","webapps"],"campaign_type":null,"search_a":"'-126347':14A,17A '-2026':13A,16A 'attack':9A 'attacker-control':8A 'control':10A 'craft':2A 'cve':12A,15A 'host':11A 'path':4A 'redirect':3A 'send':5A 'tornado':1A 'user':6A","search_b":"'app':23B 'attack':36B,44B 'browser':57B 'craft':64B 'destin':48B,65B 'differ':61B 'host':69B 'input':45B 'lead':53B 'let':43B 'outsid':68B 'packag':18B 'pars':58B 'python':19B,55B 'reach':66B 'redirecthandl':26B 'send':31B 'shape':46B 'site':38B 'slash':54B 'templat':42B 'three':50B 'tornado':20B,24B 'trick':29B 'url':41B,60B 'use':49B 'user':33B 'web':22B 'web-app':21B","search_c":"'-116578':142C '-2026':141C '6.6.0':83C,145C '6.6.1':158C 'address':149C 'allow':91C,123C 'applic':84C 'asynchron':77C 'attack':93C,134C 'attacker-control':92C,133C 'browser':120C 'case':151C 'control':94C,135C 'craft':125C 'cve':140C 'destin':99C,126C 'differ':113C 'fix':155C 'framework':75C 'fulli':148C 'host':136C 'influenc':97C 'interpret':122C 'issu':153C 'lead':111C 'librari':79C 'network':78C 'open':105C 'pars':118C 'python':73C,115C 'redirect':106C,128C 'remedi':138C 'slash':112C 'substitut':95C 'templat':89C 'three':108C 'tornado':70C 'tornado.web.redirecthandler':86C 'url':88C,117C,121C 'use':85C,107C 'user':130C 'version':81C,144C,157C 'vulner':102C 'web':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T22:21:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126347","severity":null,"published_at":"2026-11-12T22:19:19+00:00","modified_at":"2026-11-12T22:19:19+00:00","first_seen_at":"2026-11-12T22:40:37+00:00","fetched_at":"2026-11-12T22:40:37+00:00","note":null}],"documents":[{"id":139802,"url":"https://github.com/tornadoweb/tornado/commit/c503241622c0efe7c40110d89834ce8b7fead1e4","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":139803,"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-5cjw-f85j-cv6r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-09T22:21:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}