CVE-2026-116578: Tornado: Open redirect in RedirectHandler via protocol-relative URLs
Vulnerability summary
CVE-2026-116578 is a low (CVSS 2.1) URL Redirection to Untrusted Site vulnerability in tornadoweb tornado. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.7% of scored vulnerabilities.
Not severe (CVSS 2.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 26-10-2026PublishedVulnerability first disclosed.
- 30-10-2026Last modifiedVulnerability information updated.
Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.
CVSS metrics
6 scores · 6 sources · 1 version- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
- OSV · PypiEcosystem advisory · calculated2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
- OSV · ChainguardEcosystem advisory · calculated2.1LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard8 products
- dask-kubernetesAll versions (No fix recorded)
- dask-kubernetes-fipsAll versions (No fix recorded)
- jupyterhub-k8s-singleuser-sampleAll versions (No fix recorded) | < 4.4.4-r3
- litellmAll versions (No fix recorded) | < 1.106.6-r3
- litellm-fipsAll versions (No fix recorded) | < 1.106.6-r3
Debian1 product
- python-tornadoAll versions (No fix recorded)
PyPI1 product
- tornado< 6.6
Tornadoweb1 product
- tornado< 6.6
Ubuntu1 product
- python-tornadoAll versions (No fix recorded)
Wolfi1 product
- dask-kubernetesAll versions (No fix recorded)
6 vendors · 13 products
References
12 links- github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4pX Refsource CONFIRMREPORTWEBAdvisory
- github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233X Refsource MISCREPORTWEBFIX
- github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117X Refsource MISCREPORTWEBFIX
- github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035X Refsource MISCREPORTWEBFIX
