Open redirect in Tornado - CVE-2026-116578
Published: November 9, 2026
Vulnerability identifier: #VU162933
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116578
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to redirect users from an affected application's domain to an attacker-controlled site for phishing.
The vulnerability exists due to insufficient validation of request-path substitutions in Tornado's RedirectHandler when a configured URL template lets captured input influence the redirect scheme or host. An unauthenticated remote attacker can craft a link that sends a victim who follows it to a chosen external host.
Affected software
Tornado
openEuler
python-tornado
python-tornado-debuginfo
python-tornado-debugsource
python3-tornado
python-tornado-help
openEuler
python-tornado
python-tornado-debuginfo
python-tornado-debugsource
python3-tornado
python-tornado-help
How to mitigate CVE-2026-116578
Install security update from vendor's website.
Tornado - update to 6.6.0
python-tornado - update to 6.6-1
python-tornado-debuginfo - update to 6.6-1
python-tornado-debugsource - update to 6.6-1
python3-tornado - update to 6.6-1
python-tornado-help - update to 6.6-1
python-tornado - update to 6.6-1
python-tornado-debuginfo - update to 6.6-1
python-tornado-debugsource - update to 6.6-1
python3-tornado - update to 6.6-1
python-tornado-help - update to 6.6-1