Vulnerability-Lookup

GHSA-PW9P-V7R6-GX4P

Vulnerability from github – Published: 2026-10-28 22:43 – Updated: 2026-10-28 22:43

Summary

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Details

Summary

tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing.

Impact

Applications are affected if they use RedirectHandler with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:

A substitution at the start of the path, for example (r"/(.*)/target", RedirectHandler, {"url": "/{0}/destination"}). A request to https://example.com//evil.com/target redirects to //evil.com/destination, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to //.
A substitution directly after the host, for example (r"/old(.*)", RedirectHandler, {"url": "https://new.example.com{0}"}). A request to /old.evil.com/ or /old@evil.com/ redirects to evil.com.
A template that begins with a substitution (such as "{0}"), which can be given an absolute URL.

Applications are not affected if their RedirectHandler templates use only static URLs, or if every substitution comes after a fixed host and a / (for example "/static/{0}" or "https://example.com/{0}"). Other uses of RequestHandler.redirect() are not affected by this advisory, although applications that pass user-controlled input to redirect() should validate it themselves.

Patches

Fixed in Tornado 6.6. RedirectHandler now returns a 400 error if the substituted values would change the scheme or host of the redirect from what the template specifies. As a result, substitutions can no longer be used in the scheme or host part of a template. The similar check in StaticFileHandler has also been hardened against backslash and whitespace variants.

Workarounds

Change RedirectHandler templates so every substitution comes after a fixed prefix ending in /, or write capture-group regexes that cannot match characters such as /, \, @, . or : where they could affect the host.
Alternatively, replace RedirectHandler with a custom handler that validates the target before calling self.redirect().

Credit

Reported by Longwei Wang (@gn00295120).

Severity

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tornado"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-116578"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-28T22:43:45Z",
    "nvd_published_at": "2026-10-26T21:18:14Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\n`tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application\u0027s domain, which can be used in phishing.\n\n### Impact\n\nApplications are affected if they use `RedirectHandler` with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:\n\n- **A substitution at the start of the path**, for example `(r\"/(.*)/target\", RedirectHandler, {\"url\": \"/{0}/destination\"})`. A request to `https://example.com//evil.com/target` redirects to `//evil.com/destination`, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to `//`.\n- **A substitution directly after the host**, for example `(r\"/old(.*)\", RedirectHandler, {\"url\": \"https://new.example.com{0}\"})`. A request to `/old.evil.com/` or `/old@evil.com/` redirects to evil.com.\n- **A template that begins with a substitution** (such as `\"{0}\"`), which can be given an absolute URL.\n\nApplications are not affected if their `RedirectHandler` templates use only static URLs, or if every substitution comes after a fixed host and a `/` (for example `\"/static/{0}\"` or `\"https://example.com/{0}\"`). Other uses of `RequestHandler.redirect()` are not affected by this advisory, although applications that pass user-controlled input to `redirect()` should validate it themselves.\n\n### Patches\n\nFixed in Tornado 6.6. `RedirectHandler` now returns a 400 error if the substituted values would change the scheme or host of the redirect from what the template specifies. As a result, substitutions can no longer be used in the scheme or host part of a template. The similar check in `StaticFileHandler` has also been hardened against backslash and whitespace variants.\n\n### Workarounds\n\n- Change `RedirectHandler` templates so every substitution comes after a fixed prefix ending in `/`, or write capture-group regexes that cannot match characters such as `/`, `\\`, `@`, `.` or `:` where they could affect the host.\n- Alternatively, replace `RedirectHandler` with a custom handler that validates the target before calling `self.redirect()`.\n\n### Credit\n\nReported by Longwei Wang (@gn00295120).",
  "id": "GHSA-pw9p-v7r6-gx4p",
  "modified": "2026-10-28T22:43:45Z",
  "published": "2026-10-28T22:43:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116578"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tornadoweb/tornado/pull/3786"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tornadoweb/tornado"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tornadoweb/tornado/releases/tag/v6.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Tornado: Open redirect in RedirectHandler via protocol-relative URLs"
}

CVE-2026-116578 (GCVE-0-2026-116578)

Vulnerability from cvelistv5 – Published: 2026-10-26 20:22 – Updated: 2026-10-26 20:22

Title

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/tornadoweb/tornado/security/ad…	x_refsource_CONFIRM
https://github.com/tornadoweb/tornado/pull/3786	x_refsource_MISC
https://github.com/tornadoweb/tornado/commit/940e…	x_refsource_MISC
https://github.com/tornadoweb/tornado/commit/cc75…	x_refsource_MISC
https://github.com/tornadoweb/tornado/commit/ccb6…	x_refsource_MISC
https://github.com/tornadoweb/tornado/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tornadoweb	tornado	Affected: < 6.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "tornado",
          "vendor": "tornadoweb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application\u0027s domain for phishing. This issue is fixed in version 6.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T20:22:32.217Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p"
        },
        {
          "name": "https://github.com/tornadoweb/tornado/pull/3786",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tornadoweb/tornado/pull/3786"
        },
        {
          "name": "https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233"
        },
        {
          "name": "https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117"
        },
        {
          "name": "https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035"
        },
        {
          "name": "https://github.com/tornadoweb/tornado/releases/tag/v6.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tornadoweb/tornado/releases/tag/v6.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-pw9p-v7r6-gx4p",
        "discovery": "UNKNOWN"
      },
      "title": "Tornado: Open redirect in RedirectHandler via protocol-relative URLs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116578",
    "datePublished": "2026-10-26T20:22:32.217Z",
    "dateReserved": "2026-10-26T15:03:39.035Z",
    "dateUpdated": "2026-10-26T20:22:32.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-PW9P-V7R6-GX4P

Summary

Impact

Patches

Workarounds

Credit

CVE-2026-116578 (GCVE-0-2026-116578)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour