CVE-2026-116578

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.

• CWE-601

• https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233
• https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117
• https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035
• https://github.com/tornadoweb/tornado/pull/3786
• https://github.com/tornadoweb/tornado/releases/tag/v6.6.0
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11656Use after free in ServiceWorker in Google Chrome prior to 14…8.3
• CVE-2026-116566socket.getaddrinfo() previously accepted null bytes within *…5.3
• CVE-2026-11657Use after free in Payments in Google Chrome on Mac prior to …8.8
• CVE-2026-116575Mem0 provides persistent memory infrastructure for AI agents…6.3
• CVE-2026-116576systeminformation is a System and OS information library for…7.8
• CVE-2026-116577Tornado is a Python web framework and asynchronous networkin…5.3
• CVE-2026-116579Autobahn Python is a WebSocket and WAMP implementation for P…5.9
• CVE-2026-11658Insufficient validation of untrusted input in Extensions in …6.5
• CVE-2026-116580Seroval facilitates JavaScript value stringification, includ…7.3
• CVE-2026-116581Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116582Seroval facilitates JavaScript value stringification, includ…4.7
• CVE-2026-116583Seroval facilitates JavaScript value stringification, includ…5.3