Tornado is a Python web framework and asynchronous networking library.
CVE-2026-116578
Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing. Impact Applications are affected if they use RedirectHandler with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes: A substitution at the start of the path, for example (r"/(.)/target", RedirectHandler, {"url": "/{0}/destination"}). A request to https://example.com//evil.com/target redirects to //evil.com/destination, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to //. A substitution directly after the host, for example (r"/old(.)", RedirectHandler, {"url": "https://new.example.com{0}"}). A request to /old.evil.com/ or /old@evil.com/ redirects to evil.com. A template that begins with a substitution (such as "{0}"), which can be given an absolute URL. Applications are not…
Assessment
- CVSS
- 2.1 (v4.0)
- Severity
- Low
- EPSS
- 0.00459% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 30 October 2026
- Affected
- pip · tornado
- Weakness
- CWE-601
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
At the source
References
- https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233
- https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117
- https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035
- https://github.com/tornadoweb/tornado/pull/3786
- https://github.com/tornadoweb/tornado/releases/tag/v6.6.0
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p
- https://nvd.nist.gov/vuln/detail/CVE-2026-116578
- https://github.com/advisories/GHSA-pw9p-v7r6-gx4p
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-116578