Open redirect in Tornado - CVE-2026-126347
Published: November 10, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU164352
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126347
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect users to an untrusted website.
The vulnerability exists due to inconsistent URL parsing between browsers and Python's urllib in Tornado's RedirectHandler when validating redirect paths starting with three or more slashes. A remote attacker can trick a user into following a crafted link with a triple-slash redirect path to bypass open-redirect detection and redirect the browser to an untrusted website.
Affected software
Tornado
How to mitigate CVE-2026-126347
Install security update from vendor's website.
Tornado - update to 6.6.1